IP divert sockets use their inpcbinfo for port reservation, although not
for lookup.  I missed its call to in_pcbbind() when preparing previous
patches, which would lead to a lock assertion failure (although problem
not an actual race condition due to global pcbinfo locks providing
required synchronisation -- in this particular case only).  This change
adds the missing locking of the pcbhash lock.

(Existing comments in the ipdivert code question the need for using the
global hash to manage the namespace, as really it's a simple port    
namespace and not an address/port namespace.  Also, although in_pcbbind
is used to manage reservations, the hash tables aren't used for lookup.
It might be a good idea to make them use hashed lookup, or to use a
different reservation scheme.)

Reviewed by:	bz
Reported by:	Kristof Provost <kristof at sigsegv.be>
Sponsored by:	Juniper Networks

Index: ip_divert.c
===================================================================
--- ip_divert.c	(revision 222672)
+++ ip_divert.c	(working copy)
@@ -530,7 +530,9 @@
 	((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;
 	INP_INFO_WLOCK(&V_divcbinfo);
 	INP_WLOCK(inp);
+	INP_HASH_WLOCK(&V_divcbinfo);
 	error = in_pcbbind(inp, nam, td->td_ucred);
+	INP_HASH_WUNLOCK(&V_divcbinfo);
 	INP_WUNLOCK(inp);
 	INP_INFO_WUNLOCK(&V_divcbinfo);
 	return error;