Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 17 Jul 2012 13:03:47 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r238550 - head/sys/netinet
Message-ID:  <201207171303.q6HD3lZY055690@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: tuexen
Date: Tue Jul 17 13:03:47 2012
New Revision: 238550
URL: http://svn.freebsd.org/changeset/base/238550

Log:
  Fix a refcount bug when freeing an association.
  While there: Change code to be consistent.
  Discussed with rrs@.
  MFC after: 3 days

Modified:
  head/sys/netinet/sctp_pcb.c
  head/sys/netinet/sctputil.c

Modified: head/sys/netinet/sctp_pcb.c
==============================================================================
--- head/sys/netinet/sctp_pcb.c	Tue Jul 17 11:33:24 2012	(r238549)
+++ head/sys/netinet/sctp_pcb.c	Tue Jul 17 13:03:47 2012	(r238550)
@@ -4875,6 +4875,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, 
 		/* now clean up any chunks here */
 		TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
 			TAILQ_REMOVE(&outs->outqueue, sp, next);
+			sctp_free_spbufspace(stcb, asoc, sp);
 			if (sp->data) {
 				if (so) {
 					/* Still an open socket - report */
@@ -4885,19 +4886,14 @@ sctp_free_assoc(struct sctp_inpcb *inp, 
 					sctp_m_freem(sp->data);
 					sp->data = NULL;
 					sp->tail_mbuf = NULL;
+					sp->length = 0;
 				}
 			}
 			if (sp->net) {
 				sctp_free_remote_addr(sp->net);
 				sp->net = NULL;
 			}
-			sctp_free_spbufspace(stcb, asoc, sp);
-			if (sp->holds_key_ref)
-				sctp_auth_key_release(stcb, sp->auth_keyid, SCTP_SO_LOCKED);
-			/* Free the zone stuff  */
-			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_strmoq), sp);
-			SCTP_DECR_STRMOQ_COUNT();
-			/* sa_ignore FREED_MEMORY */
+			sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
 		}
 	}
 	/* sa_ignore FREED_MEMORY */

Modified: head/sys/netinet/sctputil.c
==============================================================================
--- head/sys/netinet/sctputil.c	Tue Jul 17 11:33:24 2012	(r238549)
+++ head/sys/netinet/sctputil.c	Tue Jul 17 13:03:47 2012	(r238550)
@@ -3774,6 +3774,8 @@ sctp_report_all_outbound(struct sctp_tcb
 				if (sp->data) {
 					sctp_m_freem(sp->data);
 					sp->data = NULL;
+					sp->tail_mbuf = NULL;
+					sp->length = 0;
 				}
 			}
 			if (sp->net) {
@@ -4833,7 +4835,7 @@ sctp_release_pr_sctp_chunk(struct sctp_t
 					/*
 					 * Pull any data to free up the SB
 					 * and allow sender to "add more"
-					 * whilc we will throw away :-)
+					 * while we will throw away :-)
 					 */
 					sctp_free_spbufspace(stcb, &stcb->asoc,
 					    sp);
@@ -4841,9 +4843,9 @@ sctp_release_pr_sctp_chunk(struct sctp_t
 					do_wakeup_routine = 1;
 					sp->some_taken = 1;
 					sctp_m_freem(sp->data);
-					sp->length = 0;
 					sp->data = NULL;
 					sp->tail_mbuf = NULL;
+					sp->length = 0;
 				}
 				break;
 			}

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201207171303.q6HD3lZY055690>