inpt_lastport is never read without being written before, and only in_pcbbind() and in6_pcbsetport() are using it. This diff removes inpt_lastport from struct inpcbtable and turns it into a local variable where it is used.
Ok ? -- Vincent Index: sys/netinet/in_pcb.c =================================================================== RCS file: /cvs/src/sys/netinet/in_pcb.c,v retrieving revision 1.179 diff -u -p -r1.179 in_pcb.c --- sys/netinet/in_pcb.c 11 Sep 2015 15:29:47 -0000 1.179 +++ sys/netinet/in_pcb.c 12 Sep 2015 12:22:03 -0000 @@ -199,7 +199,6 @@ in_pcbinit(struct inpcbtable *table, int &table->inpt_lhash); if (table->inpt_lhashtbl == NULL) panic("in_pcbinit: hashinit failed for lport"); - table->inpt_lastport = 0; table->inpt_count = 0; arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); } @@ -281,9 +280,8 @@ in_pcbbind(struct inpcb *inp, struct mbu { struct socket *so = inp->inp_socket; struct inpcbtable *table = inp->inp_table; - u_int16_t *lastport = &inp->inp_table->inpt_lastport; struct sockaddr_in *sin; - u_int16_t lport = 0; + u_int16_t lastport, lport = 0; int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); int error; @@ -391,16 +389,16 @@ in_pcbbind(struct inpcb *inp, struct mbu */ count = first - last; if (count) - *lastport = first - arc4random_uniform(count); + lastport = first - arc4random_uniform(count); do { if (count-- < 0) /* completely used? */ return (EADDRNOTAVAIL); - --*lastport; - if (*lastport > first || *lastport < last) - *lastport = first; - lport = htons(*lastport); - } while (in_baddynamic(*lastport, so->so_proto->pr_protocol) || + --lastport; + if (lastport > first || lastport < last) + lastport = first; + lport = htons(lastport); + } while (in_baddynamic(lastport, so->so_proto->pr_protocol) || in_pcblookup(table, &zeroin_addr, 0, &inp->inp_laddr, lport, wild, inp->inp_rtableid)); } else { @@ -409,16 +407,16 @@ in_pcbbind(struct inpcb *inp, struct mbu */ count = last - first; if (count) - *lastport = first + arc4random_uniform(count); + lastport = first + arc4random_uniform(count); do { if (count-- < 0) /* completely used? */ return (EADDRNOTAVAIL); - ++*lastport; - if (*lastport < first || *lastport > last) - *lastport = first; - lport = htons(*lastport); - } while (in_baddynamic(*lastport, so->so_proto->pr_protocol) || + ++lastport; + if (lastport < first || lastport > last) + lastport = first; + lport = htons(lastport); + } while (in_baddynamic(lastport, so->so_proto->pr_protocol) || in_pcblookup(table, &zeroin_addr, 0, &inp->inp_laddr, lport, wild, inp->inp_rtableid)); } Index: sys/netinet/in_pcb.h =================================================================== RCS file: /cvs/src/sys/netinet/in_pcb.h,v retrieving revision 1.89 diff -u -p -r1.89 in_pcb.h --- sys/netinet/in_pcb.h 16 Apr 2015 19:24:13 -0000 1.89 +++ sys/netinet/in_pcb.h 12 Sep 2015 12:22:03 -0000 @@ -152,7 +152,6 @@ struct inpcbtable { struct inpcbhead *inpt_hashtbl, *inpt_lhashtbl; SIPHASH_KEY inpt_key; u_long inpt_hash, inpt_lhash; - u_int16_t inpt_lastport; int inpt_count; }; Index: sys/netinet6/in6_pcb.c =================================================================== RCS file: /cvs/src/sys/netinet6/in6_pcb.c,v retrieving revision 1.74 diff -u -p -r1.74 in6_pcb.c --- sys/netinet6/in6_pcb.c 11 Sep 2015 15:29:47 -0000 1.74 +++ sys/netinet6/in6_pcb.c 12 Sep 2015 12:22:07 -0000 @@ -294,8 +294,7 @@ in6_pcbsetport(struct in6_addr *laddr, s struct socket *so = inp->inp_socket; struct inpcbtable *table = inp->inp_table; u_int16_t first, last; - u_int16_t *lastport = &inp->inp_table->inpt_lastport; - u_int16_t lport = 0; + u_int16_t lastport, lport = 0; int count; int wild = INPLOOKUP_IPV6; int error; @@ -334,16 +333,16 @@ in6_pcbsetport(struct in6_addr *laddr, s */ count = first - last; if (count) - *lastport = first - arc4random_uniform(count); + lastport = first - arc4random_uniform(count); do { if (count-- < 0) /* completely used? */ return (EADDRNOTAVAIL); - --*lastport; - if (*lastport > first || *lastport < last) - *lastport = first; - lport = htons(*lastport); - } while (in_baddynamic(*lastport, so->so_proto->pr_protocol) || + --lastport; + if (lastport > first || lastport < last) + lastport = first; + lport = htons(lastport); + } while (in_baddynamic(lastport, so->so_proto->pr_protocol) || in_pcblookup(table, &zeroin6_addr, 0, &inp->inp_laddr6, lport, wild, inp->inp_rtableid)); } else { @@ -352,16 +351,16 @@ in6_pcbsetport(struct in6_addr *laddr, s */ count = last - first; if (count) - *lastport = first + arc4random_uniform(count); + lastport = first + arc4random_uniform(count); do { if (count-- < 0) /* completely used? */ return (EADDRNOTAVAIL); - ++*lastport; - if (*lastport < first || *lastport > last) - *lastport = first; - lport = htons(*lastport); - } while (in_baddynamic(*lastport, so->so_proto->pr_protocol) || + ++lastport; + if (lastport < first || lastport > last) + lastport = first; + lport = htons(lastport); + } while (in_baddynamic(lastport, so->so_proto->pr_protocol) || in_pcblookup(table, &zeroin6_addr, 0, &inp->inp_laddr6, lport, wild, inp->inp_rtableid)); }