From owner-svn-src-all@FreeBSD.ORG Tue Jul 17 13:03:48 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 48D261065674; Tue, 17 Jul 2012 13:03:48 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 1BE628FC0C; Tue, 17 Jul 2012 13:03:48 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q6HD3lOs055693; Tue, 17 Jul 2012 13:03:47 GMT (envelope-from tuexen@svn.freebsd.org) Received: (from tuexen@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q6HD3lZY055690; Tue, 17 Jul 2012 13:03:47 GMT (envelope-from tuexen@svn.freebsd.org) Message-Id: <201207171303.q6HD3lZY055690@svn.freebsd.org> From: Michael Tuexen Date: Tue, 17 Jul 2012 13:03:47 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r238550 - head/sys/netinet X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Jul 2012 13:03:48 -0000 Author: tuexen Date: Tue Jul 17 13:03:47 2012 New Revision: 238550 URL: http://svn.freebsd.org/changeset/base/238550 Log: Fix a refcount bug when freeing an association. While there: Change code to be consistent. Discussed with rrs@. MFC after: 3 days Modified: head/sys/netinet/sctp_pcb.c head/sys/netinet/sctputil.c Modified: head/sys/netinet/sctp_pcb.c ============================================================================== --- head/sys/netinet/sctp_pcb.c Tue Jul 17 11:33:24 2012 (r238549) +++ head/sys/netinet/sctp_pcb.c Tue Jul 17 13:03:47 2012 (r238550) @@ -4875,6 +4875,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, /* now clean up any chunks here */ TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { TAILQ_REMOVE(&outs->outqueue, sp, next); + sctp_free_spbufspace(stcb, asoc, sp); if (sp->data) { if (so) { /* Still an open socket - report */ @@ -4885,19 +4886,14 @@ sctp_free_assoc(struct sctp_inpcb *inp, sctp_m_freem(sp->data); sp->data = NULL; sp->tail_mbuf = NULL; + sp->length = 0; } } if (sp->net) { sctp_free_remote_addr(sp->net); sp->net = NULL; } - sctp_free_spbufspace(stcb, asoc, sp); - if (sp->holds_key_ref) - sctp_auth_key_release(stcb, sp->auth_keyid, SCTP_SO_LOCKED); - /* Free the zone stuff */ - SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_strmoq), sp); - SCTP_DECR_STRMOQ_COUNT(); - /* sa_ignore FREED_MEMORY */ + sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); } } /* sa_ignore FREED_MEMORY */ Modified: head/sys/netinet/sctputil.c ============================================================================== --- head/sys/netinet/sctputil.c Tue Jul 17 11:33:24 2012 (r238549) +++ head/sys/netinet/sctputil.c Tue Jul 17 13:03:47 2012 (r238550) @@ -3774,6 +3774,8 @@ sctp_report_all_outbound(struct sctp_tcb if (sp->data) { sctp_m_freem(sp->data); sp->data = NULL; + sp->tail_mbuf = NULL; + sp->length = 0; } } if (sp->net) { @@ -4833,7 +4835,7 @@ sctp_release_pr_sctp_chunk(struct sctp_t /* * Pull any data to free up the SB * and allow sender to "add more" - * whilc we will throw away :-) + * while we will throw away :-) */ sctp_free_spbufspace(stcb, &stcb->asoc, sp); @@ -4841,9 +4843,9 @@ sctp_release_pr_sctp_chunk(struct sctp_t do_wakeup_routine = 1; sp->some_taken = 1; sctp_m_freem(sp->data); - sp->length = 0; sp->data = NULL; sp->tail_mbuf = NULL; + sp->length = 0; } break; }