If bind() call fails to allocate port due `prison_ip' permission failure, socket left in half-binded state (bind returns an error, but doesn't undo socket state (in case of failure bind should left inp_laddr.s_addr == INADDR_ANY && inp_lport == 0, indicating, that socket is NOT yet binded)). In upper case `bind' aborted, left in binded state, but doesn't inserted in hashlists (in_pcbinshash). Any operations with such sockets will cause dereferencing of hash pointers and lead to crash. Fix: `cvs diff -u in_pcb.c' follows: How-To-Repeat: In jail with NIS/YP environment type `id some_nis_user'.
State Changed From-To: open->closed committed, thanks!