From owner-freebsd-net@FreeBSD.ORG  Tue Jan 31 13:02:19 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C45D716A420
	for <freebsd-net@freebsd.org>; Tue, 31 Jan 2006 13:02:19 +0000 (GMT)
	(envelope-from jinmei@isl.rdc.toshiba.co.jp)
Received: from shuttle.wide.toshiba.co.jp (shuttle.wide.toshiba.co.jp
	[202.249.10.124])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1296F43D46
	for <freebsd-net@freebsd.org>; Tue, 31 Jan 2006 13:02:17 +0000 (GMT)
	(envelope-from jinmei@isl.rdc.toshiba.co.jp)
Received: from impact.jinmei.org (unknown
	[2001:200:0:8002:68bf:bbff:fdbd:f7df])
	by shuttle.wide.toshiba.co.jp (Postfix) with ESMTP id A1CF715225
	for <freebsd-net@freebsd.org>; Tue, 31 Jan 2006 22:02:13 +0900 (JST)
Date: Tue, 31 Jan 2006 22:02:07 +0900
Message-ID: <y7vlkwweek0.wl%jinmei@isl.rdc.toshiba.co.jp>
From: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?=
	<jinmei@isl.rdc.toshiba.co.jp>
To: freebsd-net@freebsd.org
User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI)
Organization: Research & Development Center, Toshiba Corp., Kawasaki, Japan.
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Subject: m_tag leak?
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 31 Jan 2006 13:02:19 -0000

While tracking a different issue, I felt I just got confused.  From a
very quick look at m_freem() and m_free(), it looks there is a leakage
of m_tag.  This is the definition of m_freem() in rev. 1.160 of
uipc_mbuf.c:

void
m_freem(struct mbuf *mb)
{

	while (mb != NULL)
		mb = m_free(mb);
}

And the following is the definition of m_free() (defined in
sys/mbuf.h, rev 1.187)

static __inline
struct mbuf *
m_free(struct mbuf *m)
{
	struct mbuf *n = m->m_next;

	if (m->m_flags & M_EXT)
		mb_free_ext(m);
	else
		uma_zfree(zone_mbuf, m);
	return n;
}

Doesn't this mean an m_tag attached to the mbuf to be freed, if any,
will remain without any reference?  Perhaps I'm missing something very
trivial.  It would be appreciated if someone could clarify that.

Thanks,

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					jinmei@isl.rdc.toshiba.co.jp