Handle sockets that are closing in parallel.

After unlocking, sockets may close on one CPU while others are
processing packets.  For TCP the socket lock prevents this.  Add a
netstat counter for dropped packets if an inpcb has no associated
socket after the lock has been acquired.

UDP, raw IP, and divert sockets rely only on reference count.  They
do not take socket lock as they have little state to protect and
want to avoid the performance penalty.  This means that
inp->inp_socket->so_pcb can become NULL anytime.  Remove a kassert
that checks this value.  All other parts of the socket are either
read only or protected by mutex.  Sockets may still receive data
into socket buffer while the socket is closing.  After releasing
all references, sorele() calls m_purge() and has to deal with it.

OK mvs@

Author: bluhm

sys/netinet/tcp_input.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_input.c,v 1.452 2025/06/12 19:10:17 bluhm Exp $	*/
+/*	$OpenBSD: tcp_input.c,v 1.453 2025/06/18 16:15:46 bluhm Exp $	*/
 /*	$NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $	*/
 
 /*
@@ -661,10 +661,9 @@ tcp_input_solocked(struct mbuf **mp, int *offp, int proto, int af,
 		so = in_pcbsolock(inp);
 	}
 	if (so == NULL) {
-		tcpstat_inc(tcps_noport);
+		tcpstat_inc(tcps_closing);
 		goto dropwithreset_ratelim;
 	}
-
 	KASSERT(sotoinpcb(inp->inp_socket) == inp);
 	KASSERT(intotcpcb(inp) == NULL || intotcpcb(inp)->t_inpcb == inp);
 	soassertlocked(inp->inp_socket);

sys/netinet/tcp_var.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_var.h,v 1.194 2025/06/17 03:48:14 dlg Exp $	*/
+/*	$OpenBSD: tcp_var.h,v 1.195 2025/06/18 16:15:46 bluhm Exp $	*/
 /*	$NetBSD: tcp_var.h,v 1.17 1996/02/13 23:44:24 christos Exp $	*/
 
 /*
@@ -392,6 +392,7 @@ struct	tcpstat {
 
 	u_int32_t tcps_pcbhashmiss;	/* input packets missing pcb hash */
 	u_int32_t tcps_noport;		/* no socket on port */
+	u_int32_t tcps_closing;		/* inpcb exists, socket is closing */
 	u_int32_t tcps_badsyn;		/* SYN packet with src==dst rcv'ed */
 	u_int32_t tcps_dropsyn;		/* SYN packet dropped */
 
@@ -582,6 +583,7 @@ enum tcpstat_counters {
 	tcps_preddat,
 	tcps_pcbhashmiss,
 	tcps_noport,
+	tcps_closing,
 	tcps_badsyn,
 	tcps_dropsyn,
 	tcps_rcvbadsig,

sys/netinet/udp_usrreq.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.343 2025/06/16 07:11:58 mvs Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.344 2025/06/18 16:15:46 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -602,7 +602,6 @@ udp_input(struct mbuf **mp, int *offp, int proto, int af, struct netstack *ns)
 		return IPPROTO_DONE;
 	}
 
-	KASSERT(sotoinpcb(inp->inp_socket) == inp);
 	soassertlocked_readonly(inp->inp_socket);
 
 #ifdef INET6

usr.bin/netstat/inet.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet.c,v 1.184 2025/04/17 17:23:17 bluhm Exp $	*/
+/*	$OpenBSD: inet.c,v 1.185 2025/06/18 16:15:46 bluhm Exp $	*/
 /*	$NetBSD: inet.c,v 1.14 1995/10/03 21:42:37 thorpej Exp $	*/
 
 /*
@@ -468,6 +468,7 @@ tcp_stats(char *name)
 	p(tcps_preddat, "\t%u correct data packet header prediction%s\n");
 	pes(tcps_pcbhashmiss, "\t%u PCB cache miss%s\n");
 	p1(tcps_noport, "\t%u dropped due to no socket\n");
+	p1(tcps_closing, "\t%u dropped as socket is closing\n");
 
 	p(tcps_ecn_accepts, "\t%u ECN connection%s accepted\n");
 	p(tcps_ecn_rcvece, "\t\t%u ECE packet%s received\n");