From owner-svn-src-all@FreeBSD.ORG  Thu Feb 28 17:52:27 2013
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id CE30D613;
 Thu, 28 Feb 2013 17:52:27 +0000 (UTC)
 (envelope-from carpeddiem@gmail.com)
Received: from mail-oa0-f41.google.com (mail-oa0-f41.google.com
 [209.85.219.41]) by mx1.freebsd.org (Postfix) with ESMTP id 74C3F6ED;
 Thu, 28 Feb 2013 17:52:27 +0000 (UTC)
Received: by mail-oa0-f41.google.com with SMTP id i10so4176219oag.14
 for <multiple recipients>; Thu, 28 Feb 2013 09:52:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:x-received:sender:in-reply-to:references:date
 :x-google-sender-auth:message-id:subject:from:to:cc:content-type;
 bh=p/SVAaCU2S0Q3gzbxnTKtzc4jIqyy8FhnEcOeOtP2Wc=;
 b=VKqbYuluzawffirRVmlEATJuKSO+0KkluoU6st4+N0R6sIlpFVFg2nA2/SUFRKTyuk
 ASTt69Mwy5clI+tV2FO7eJgFcA7h9OmAwEJgVBqsxSb+qdjp1G3kknF7tZFYPkYgpNtQ
 Ak1XevdqmtdAmOngi10wK4IS5cY2ctMiRTYqswRmCbytGfS4CanbafXHWUTM+VZd+XQn
 IoLxHzaCNUJuXXQL1NaABEs/Nba/tFNs9N/jBMiO4/zFsfV8DDRK89Y9POnRQkNCJCX+
 aLT7F5UQSHQ5XRco2XoG/UYhJe/v6EiBp7FcpUE4qr77HGTsdYbb0VqNqpsY8Qqcm47h
 2Oug==
MIME-Version: 1.0
X-Received: by 10.60.169.231 with SMTP id ah7mr6109646oec.142.1362073947011;
 Thu, 28 Feb 2013 09:52:27 -0800 (PST)
Sender: carpeddiem@gmail.com
Received: by 10.60.150.239 with HTTP; Thu, 28 Feb 2013 09:52:26 -0800 (PST)
In-Reply-To: <201212121741.qBCHfM6Q008489@svn.freebsd.org>
References: <201212121741.qBCHfM6Q008489@svn.freebsd.org>
Date: Thu, 28 Feb 2013 12:52:26 -0500
X-Google-Sender-Auth: tAK49L4Z8deqlIXWlPY5jzD5NCA
Message-ID: <CAPyFy2Ashh8Tm+zzVzOi4Z3XvkNBpBCKjgUaHRYHn80Zqwyyeg@mail.gmail.com>
Subject: Re: svn commit: r244157 - head/sys/netinet
From: Ed Maste <emaste@freebsd.org>
To: Gleb Smirnoff <glebius@freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1
Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org,
 src-committers@freebsd.org
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Feb 2013 17:52:27 -0000

On 12 December 2012 12:41, Gleb Smirnoff <glebius@freebsd.org> wrote:
> Author: glebius
> Date: Wed Dec 12 17:41:21 2012
> New Revision: 244157
> URL: http://svnweb.freebsd.org/changeset/base/244157
>
> Log:
>     Fix a crash in tcp_input(), that happens when mbuf has a fwd_tag on it,
>   but later after processing and freeing the tag, we need to jump back again
>   to the findpcb label. Since the fwd_tag pointer wasn't NULL we tried to
>   process and free the tag for second time.

This will fix the crash, but I worry that packets matching the
TIMEWAIT cases that previously caused the crash will now fail to be
forwarded instead.

I'm looking at separating the detach and free of the fwd_tag to address this.