***************
*** 19,125 ****
  
  	xig.xig_len = sizeof xig;
  	xig.xig_count = n + m;
  	xig.xig_gen = gencnt;
  	xig.xig_sogen = so_gencnt;
  	error = SYSCTL_OUT(req, &xig, sizeof xig);
  	if (error)
  		return (error);
  
  	error = syncache_pcblist(req, m, &pcb_count);
  	if (error)
  		return (error);
  
  	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
  	if (inp_list == NULL)
  		return (ENOMEM);
  
  	INP_INFO_RLOCK(&V_tcbinfo);
  	for (inp = LIST_FIRST(V_tcbinfo.ipi_listhead), i = 0;
  	    inp != NULL && i < n; inp = LIST_NEXT(inp, inp_list)) {
! 		INP_WLOCK(inp);
  		if (inp->inp_gencnt <= gencnt) {
  			/*
  			 * XXX: This use of cr_cansee(), introduced with
  			 * TCP state changes, is not quite right, but for
  			 * now, better than nothing.
  			 */
  			if (inp->inp_flags & INP_TIMEWAIT) {
  				if (intotw(inp) != NULL)
  					error = cr_cansee(req->td->td_ucred,
  					    intotw(inp)->tw_cred);
  				else
  					error = EINVAL;	/* Skip this inp. */
  			} else
  				error = cr_canseeinpcb(req->td->td_ucred, inp);
! 			if (error == 0) {
! 				in_pcbref(inp);
! 				inp_list[i++] = inp;
  			}
- 		}
- 		INP_WUNLOCK(inp);
- 	}
- 	INP_INFO_RUNLOCK(&V_tcbinfo);
- 	n = i;
- 
- 	error = 0;
- 	for (i = 0; i < n; i++) {
- 		inp = inp_list[i];
- 		INP_RLOCK(inp);
- 		if (inp->inp_gencnt <= gencnt) {
- 			struct xtcpcb xt;
- 			void *inp_ppcb;
- 
  			bzero(&xt, sizeof(xt));
  			xt.xt_len = sizeof xt;
  			/* XXX should avoid extra copy */
  			bcopy(inp, &xt.xt_inp, sizeof *inp);
  			inp_ppcb = inp->inp_ppcb;
  			if (inp_ppcb == NULL)
  				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
  			else if (inp->inp_flags & INP_TIMEWAIT) {
  				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
  				xt.xt_tp.t_state = TCPS_TIME_WAIT;
  			} else {
  				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
  				if (xt.xt_tp.t_timers)
  					tcp_timer_to_xtimer(&xt.xt_tp, xt.xt_tp.t_timers, &xt.xt_timer);
  			}
  			if (inp->inp_socket != NULL)
  				sotoxsocket(inp->inp_socket, &xt.xt_socket);
  			else {
  				bzero(&xt.xt_socket, sizeof xt.xt_socket);
  				xt.xt_socket.xso_protocol = IPPROTO_TCP;
  			}
  			xt.xt_inp.inp_gencnt = inp->inp_gencnt;
  			INP_RUNLOCK(inp);
  			error = SYSCTL_OUT(req, &xt, sizeof xt);
  		} else
  			INP_RUNLOCK(inp);
  	}
- 	INP_INFO_WLOCK(&V_tcbinfo);
- 	for (i = 0; i < n; i++) {
- 		inp = inp_list[i];
- 		INP_RLOCK(inp);
- 		if (!in_pcbrele_rlocked(inp))
- 			INP_RUNLOCK(inp);
- 	}
- 	INP_INFO_WUNLOCK(&V_tcbinfo);
- 
  	if (!error) {
  		/*
  		 * Give the user an updated idea of our state.
  		 * If the generation differs from what we told
  		 * her before, she knows that something happened
  		 * while we were processing this request, and it
  		 * might be necessary to retry.
  		 */
  		INP_INFO_RLOCK(&V_tcbinfo);
  		xig.xig_gen = V_tcbinfo.ipi_gencnt;
  		xig.xig_sogen = so_gencnt;
  		xig.xig_count = V_tcbinfo.ipi_count + pcb_count;
  		INP_INFO_RUNLOCK(&V_tcbinfo);
  		error = SYSCTL_OUT(req, &xig, sizeof xig);
  	}
  	free(inp_list, M_TEMP);
  	return (error);
  }
--- 19,114 ----
  
  	xig.xig_len = sizeof xig;
  	xig.xig_count = n + m;
  	xig.xig_gen = gencnt;
  	xig.xig_sogen = so_gencnt;
  	error = SYSCTL_OUT(req, &xig, sizeof xig);
  	if (error)
  		return (error);
  
  	error = syncache_pcblist(req, m, &pcb_count);
  	if (error)
  		return (error);
  
  	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
  	if (inp_list == NULL)
  		return (ENOMEM);
  
  	INP_INFO_RLOCK(&V_tcbinfo);
  	for (inp = LIST_FIRST(V_tcbinfo.ipi_listhead), i = 0;
  	    inp != NULL && i < n; inp = LIST_NEXT(inp, inp_list)) {
! 		inp_list[i++] = inp;
! 	}
! 	INP_INFO_RUNLOCK(&V_tcbinfo);
! 	n = i;
! 
! 	error = 0;
! 	for (i = 0; i < n; i++) {
! 		inp = inp_list[i];
! 		INP_RLOCK(inp);
  		if (inp->inp_gencnt <= gencnt) {
+ 			struct xtcpcb xt;
+ 			void *inp_ppcb;
+ 
  			/*
  			 * XXX: This use of cr_cansee(), introduced with
  			 * TCP state changes, is not quite right, but for
  			 * now, better than nothing.
  			 */
  			if (inp->inp_flags & INP_TIMEWAIT) {
  				if (intotw(inp) != NULL)
  					error = cr_cansee(req->td->td_ucred,
  					    intotw(inp)->tw_cred);
  				else
  					error = EINVAL;	/* Skip this inp. */
  			} else
  				error = cr_canseeinpcb(req->td->td_ucred, inp);
! 			if (error) {
! 				error = 0;
! 				INP_RUNLOCK(inp);
! 				continue;
  			}
  			bzero(&xt, sizeof(xt));
  			xt.xt_len = sizeof xt;
  			/* XXX should avoid extra copy */
  			bcopy(inp, &xt.xt_inp, sizeof *inp);
  			inp_ppcb = inp->inp_ppcb;
  			if (inp_ppcb == NULL)
  				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
  			else if (inp->inp_flags & INP_TIMEWAIT) {
  				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
  				xt.xt_tp.t_state = TCPS_TIME_WAIT;
  			} else {
  				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
  				if (xt.xt_tp.t_timers)
  					tcp_timer_to_xtimer(&xt.xt_tp, xt.xt_tp.t_timers, &xt.xt_timer);
  			}
  			if (inp->inp_socket != NULL)
  				sotoxsocket(inp->inp_socket, &xt.xt_socket);
  			else {
  				bzero(&xt.xt_socket, sizeof xt.xt_socket);
  				xt.xt_socket.xso_protocol = IPPROTO_TCP;
  			}
  			xt.xt_inp.inp_gencnt = inp->inp_gencnt;
  			INP_RUNLOCK(inp);
  			error = SYSCTL_OUT(req, &xt, sizeof xt);
  		} else
  			INP_RUNLOCK(inp);
  	}
  	if (!error) {
  		/*
  		 * Give the user an updated idea of our state.
  		 * If the generation differs from what we told
  		 * her before, she knows that something happened
  		 * while we were processing this request, and it
  		 * might be necessary to retry.
  		 */
  		INP_INFO_RLOCK(&V_tcbinfo);
  		xig.xig_gen = V_tcbinfo.ipi_gencnt;
  		xig.xig_sogen = so_gencnt;
  		xig.xig_count = V_tcbinfo.ipi_count + pcb_count;
  		INP_INFO_RUNLOCK(&V_tcbinfo);
  		error = SYSCTL_OUT(req, &xig, sizeof xig);
  	}
  	free(inp_list, M_TEMP);
  	return (error);
  }