Fix panic while setting TCP_CORK off.

TCP sender is initialized only in established state, check if sender is
available before disabling the TCP_CORK timer.

Reported-by: syzbot+653ff342d39edb34a49c@syzkaller.appspotmail.com
PiperOrigin-RevId: 616879762

pkg/tcpip/transport/tcp/endpoint.go

@@ -1763,7 +1763,9 @@ func (e *endpoint) OnCorkOptionSet(v bool) {
 	if !v {
 		e.LockUser()
 		defer e.UnlockUser()
-		e.snd.corkTimer.disable()
+		if e.snd != nil {
+			e.snd.corkTimer.disable()
+		}
 		// Handle the corked data.
 		if e.EndpointState().connected() {
 			e.sendData(nil /* next */)

test/syscalls/linux/tcp_socket.cc

@@ -2696,6 +2696,15 @@ TEST_P(SimpleTcpSocketTest, EpollListeningSocket) {
   save_and_connect_thread.Join();
 }
 
+TEST_P(SimpleTcpSocketTest, SetTCPCorkOff) {
+  int fd;
+  ASSERT_THAT(fd = socket(GetParam(), SOCK_STREAM, IPPROTO_TCP),
+              SyscallSucceeds());
+
+  ASSERT_THAT(
+      setsockopt(fd, IPPROTO_TCP, TCP_CORK, &kSockOptOff, sizeof(kSockOptOff)),
+      SyscallSucceeds());
+}
 #endif  // __linux__
 
 INSTANTIATE_TEST_SUITE_P(AllInetTests, SimpleTcpSocketTest,