Don't allow allocating a new send tag on an INP which is being torn down.

This fixes a potential send tag leak.

Reviewed by:	rrs@
MFC after:	1 week
Sponsored by:	Mellanox Technologies // NVIDIA Networking

sys/netinet/in_pcb.c

@@ -3399,7 +3399,12 @@ in_pcbattach_txrtlmt(struct inpcb *inp, struct ifnet *ifp,
 
 	INP_WLOCK_ASSERT(inp);
 
-	if (*st != NULL)
+	/*
+	 * If there is already a send tag, or the INP is being torn
+	 * down, allocating a new send tag is not allowed. Else send
+	 * tags may leak.
+	 */
+	if (*st != NULL || (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) != 0)
 		return (EINVAL);
 
 	error = m_snd_tag_alloc(ifp, &params, st);