Date: Sun, 11 Apr 2010 16:04:08 +0000 (UTC) From: "Bjoern A. Zeeb" <bz@FreeBSD.org> To: cvs-src-old@freebsd.org Subject: cvs commit: src/sys/net if_llatbl.c src/sys/netinet if_ether.c in.c src/sys/netinet6 in6.c nd6.c Message-ID: <201004111605.o3BG50tk060893@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
bz 2010-04-11 16:04:08 UTC
FreeBSD src repository
Modified files:
sys/net if_llatbl.c
sys/netinet if_ether.c in.c
sys/netinet6 in6.c nd6.c
Log:
SVN rev 206481 on 2010-04-11 16:04:08Z by bz
Plug reference leaks in the link-layer code ("new-arp") that previously
prevented the link-layer entry from being freed.
In both in.c and in6.c (though that code path seems to be basically dead)
plug a reference leak in case of a pending callout being drained.
In if_ether.c consistently add a reference before resetting the callout
and in case we canceled a pending one remove the reference for that.
In the final case in arptimer, before freeing the expired entry, remove
the reference again and explicitly call callout_stop() to clear the active
flag.
In nd6.c:nd6_free() we are only ever called from the callout function and
thus need to remove the reference there as well before calling into
llentry_free().
In if_llatbl.c when freeing entire tables make sure that in case we cancel
a pending callout to remove the reference as well.
Reviewed by: qingli (earlier version)
MFC after: 10 days
Problem observed, patch tested by: simon on ipv6gw.f.o,
Christian Kratzer (ck cksoft.de),
Evgenii Davidov (dado korolev-net.ru)
PR: kern/144564
Configurations still affected: with options FLOWTABLE
Revision Changes Path
1.18 +4 -1 src/sys/net/if_llatbl.c
1.218 +15 -3 src/sys/netinet/if_ether.c
1.159 +5 -1 src/sys/netinet/in.c
1.131 +5 -1 src/sys/netinet6/in6.c
1.133 +1 -0 src/sys/netinet6/nd6.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201004111605.o3BG50tk060893>