From a0801e345934b8c139c255c8327f726a614b3267 Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Fri, 9 Feb 2018 07:32:35 +0000
Subject: [PATCH] Call socreate() before falloc() in sys_socket().

This is similar to what we do in sys_socketpair() and will allow us
to grab the KERNEL_LOCK() only after having created a socket.

ok tedu@
---
 sys/kern/uipc_syscalls.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 75918cc2f69..fb83d1bc1f6 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_syscalls.c,v 1.162 2018/01/09 15:14:23 mpi Exp $	*/
+/*	$OpenBSD: uipc_syscalls.c,v 1.163 2018/02/09 07:32:35 mpi Exp $	*/
 /*	$NetBSD: uipc_syscalls.c,v 1.19 1996/02/09 19:00:48 christos Exp $	*/
 
 /*
@@ -83,7 +83,7 @@ sys_socket(struct proc *p, void *v, register_t *retval)
 	struct file *fp;
 	int type = SCARG(uap, type);
 	int domain = SCARG(uap, domain);
-	int fd, error;
+	int fd, cloexec, nonblock, fflag, error;
 	unsigned int ss = 0;
 
 	if ((type & SOCK_DNS) && !(domain == AF_INET || domain == AF_INET6))
@@ -95,23 +95,24 @@ sys_socket(struct proc *p, void *v, register_t *retval)
 	if (error)
 		return (error);
 
-	fdplock(fdp);
-	error = falloc(p, (type & SOCK_CLOEXEC) ? UF_EXCLOSE : 0, &fp, &fd);
-	fdpunlock(fdp);
+	type &= ~(SOCK_CLOEXEC | SOCK_NONBLOCK | SOCK_DNS);
+	cloexec = (SCARG(uap, type) & SOCK_CLOEXEC) ? UF_EXCLOSE : 0;
+	nonblock = SCARG(uap, type) &  SOCK_NONBLOCK;
+	fflag = FREAD | FWRITE | (nonblock ? FNONBLOCK : 0);
+
+	error = socreate(SCARG(uap, domain), &so, type, SCARG(uap, protocol));
 	if (error != 0)
 		goto out;
 
-	fp->f_flag = FREAD | FWRITE | (type & SOCK_NONBLOCK ? FNONBLOCK : 0);
-	fp->f_type = DTYPE_SOCKET;
-	fp->f_ops = &socketops;
-	error = socreate(SCARG(uap, domain), &so,
-	    type & ~(SOCK_CLOEXEC | SOCK_NONBLOCK | SOCK_DNS), SCARG(uap, protocol));
+	fdplock(fdp);
+	error = falloc(p, cloexec, &fp, &fd);
+	fdpunlock(fdp);
 	if (error) {
-		fdplock(fdp);
-		fdremove(fdp, fd);
-		closef(fp, p);
-		fdpunlock(fdp);
+		soclose(so);
 	} else {
+		fp->f_flag = fflag;
+		fp->f_type = DTYPE_SOCKET;
+		fp->f_ops = &socketops;
 		if (type & SOCK_NONBLOCK)
 			so->so_state |= SS_NBIO;
 		so->so_state |= ss;
-- 
2.20.1