From owner-cvs-src-old@FreeBSD.ORG Sun Apr 11 16:05:00 2010 Return-Path: Delivered-To: cvs-src-old@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A91AC106566C for ; Sun, 11 Apr 2010 16:05:00 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 95D758FC14 for ; Sun, 11 Apr 2010 16:05:00 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id o3BG50s9060894 for ; Sun, 11 Apr 2010 16:05:00 GMT (envelope-from bz@repoman.freebsd.org) Received: (from svn2cvs@localhost) by repoman.freebsd.org (8.14.3/8.14.3/Submit) id o3BG50tk060893 for cvs-src-old@freebsd.org; Sun, 11 Apr 2010 16:05:00 GMT (envelope-from bz@repoman.freebsd.org) Message-Id: <201004111605.o3BG50tk060893@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to bz@repoman.freebsd.org using -f From: "Bjoern A. Zeeb" Date: Sun, 11 Apr 2010 16:04:08 +0000 (UTC) To: cvs-src-old@freebsd.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/net if_llatbl.c src/sys/netinet if_ether.c in.c src/sys/netinet6 in6.c nd6.c X-BeenThere: cvs-src-old@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: **OBSOLETE** CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Apr 2010 16:05:00 -0000 bz 2010-04-11 16:04:08 UTC FreeBSD src repository Modified files: sys/net if_llatbl.c sys/netinet if_ether.c in.c sys/netinet6 in6.c nd6.c Log: SVN rev 206481 on 2010-04-11 16:04:08Z by bz Plug reference leaks in the link-layer code ("new-arp") that previously prevented the link-layer entry from being freed. In both in.c and in6.c (though that code path seems to be basically dead) plug a reference leak in case of a pending callout being drained. In if_ether.c consistently add a reference before resetting the callout and in case we canceled a pending one remove the reference for that. In the final case in arptimer, before freeing the expired entry, remove the reference again and explicitly call callout_stop() to clear the active flag. In nd6.c:nd6_free() we are only ever called from the callout function and thus need to remove the reference there as well before calling into llentry_free(). In if_llatbl.c when freeing entire tables make sure that in case we cancel a pending callout to remove the reference as well. Reviewed by: qingli (earlier version) MFC after: 10 days Problem observed, patch tested by: simon on ipv6gw.f.o, Christian Kratzer (ck cksoft.de), Evgenii Davidov (dado korolev-net.ru) PR: kern/144564 Configurations still affected: with options FLOWTABLE Revision Changes Path 1.18 +4 -1 src/sys/net/if_llatbl.c 1.218 +15 -3 src/sys/netinet/if_ether.c 1.159 +5 -1 src/sys/netinet/in.c 1.131 +5 -1 src/sys/netinet6/in6.c 1.133 +1 -0 src/sys/netinet6/nd6.c