From owner-svn-src-all@FreeBSD.ORG  Mon Nov 28 11:14:32 2011
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id B3C1F106567D;
	Mon, 28 Nov 2011 11:14:32 +0000 (UTC)
	(envelope-from lstewart@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 8929B8FC1A;
	Mon, 28 Nov 2011 11:14:32 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id pASBEWZS088229;
	Mon, 28 Nov 2011 11:14:32 GMT
	(envelope-from lstewart@svn.freebsd.org)
Received: (from lstewart@localhost)
	by svn.freebsd.org (8.14.4/8.14.4/Submit) id pASBEWtM088227;
	Mon, 28 Nov 2011 11:14:32 GMT
	(envelope-from lstewart@svn.freebsd.org)
Message-Id: <201111281114.pASBEWtM088227@svn.freebsd.org>
From: Lawrence Stewart <lstewart@FreeBSD.org>
Date: Mon, 28 Nov 2011 11:14:32 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-releng@freebsd.org
X-SVN-Group: releng
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r228059 - releng/9.0/sys/netinet
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Nov 2011 11:14:32 -0000

Author: lstewart
Date: Mon Nov 28 11:14:32 2011
New Revision: 228059
URL: http://svn.freebsd.org/changeset/base/228059

Log:
  Fast track MFC r228016:
  
  Plug a TCP reassembly UMA zone leak introduced in r226228 by only using the
  backup stack queue entry when the zone is exhausted, otherwise we leak a zone
  allocation each time we plug a hole in the reassembly queue.
  
  Reported by:	many on freebsd-stable@ (thread: "TCP Reassembly Issues")
  Tested by:	many on freebsd-stable@ (thread: "TCP Reassembly Issues")
  Reviewed by:	bz (very brief sanity check)
  Approved by:	re (kib)

Modified:
  releng/9.0/sys/netinet/tcp_reass.c
Directory Properties:
  releng/9.0/sys/   (props changed)

Modified: releng/9.0/sys/netinet/tcp_reass.c
==============================================================================
--- releng/9.0/sys/netinet/tcp_reass.c	Mon Nov 28 11:10:12 2011	(r228058)
+++ releng/9.0/sys/netinet/tcp_reass.c	Mon Nov 28 11:14:32 2011	(r228059)
@@ -233,23 +233,28 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 	 * when the zone is exhausted. Otherwise we may get stuck.
 	 */
 	te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT);
-	if (te == NULL && th->th_seq != tp->rcv_nxt) {
-		TCPSTAT_INC(tcps_rcvmemdrop);
-		m_freem(m);
-		*tlenp = 0;
-		if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
-			log(LOG_DEBUG, "%s; %s: global zone limit reached, "
-			    "segment dropped\n", s, __func__);
-			free(s, M_TCPLOG);
-		}
-		return (0);
-	} else if (th->th_seq == tp->rcv_nxt) {
-		bzero(&tqs, sizeof(struct tseg_qent));
-		te = &tqs;
-		if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
-			log(LOG_DEBUG, "%s; %s: global zone limit reached, "
-			    "using stack for missing segment\n", s, __func__);
-			free(s, M_TCPLOG);
+	if (te == NULL) {
+		if (th->th_seq != tp->rcv_nxt) {
+			TCPSTAT_INC(tcps_rcvmemdrop);
+			m_freem(m);
+			*tlenp = 0;
+			if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL,
+			    NULL))) {
+				log(LOG_DEBUG, "%s; %s: global zone limit "
+				    "reached, segment dropped\n", s, __func__);
+				free(s, M_TCPLOG);
+			}
+			return (0);
+		} else {
+			bzero(&tqs, sizeof(struct tseg_qent));
+			te = &tqs;
+			if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL,
+			    NULL))) {
+				log(LOG_DEBUG,
+				    "%s; %s: global zone limit reached, using "
+				    "stack for missing segment\n", s, __func__);
+				free(s, M_TCPLOG);
+			}
 		}
 	}
 	tp->t_segqlen++;