From owner-cvs-src@FreeBSD.ORG  Thu Sep 21 09:55:46 2006
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E4F5716A416;
	Thu, 21 Sep 2006 09:55:46 +0000 (UTC) (envelope-from rrs@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 009E243D49;
	Thu, 21 Sep 2006 09:55:44 +0000 (GMT) (envelope-from rrs@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k8L9thLb069707;
	Thu, 21 Sep 2006 09:55:43 GMT (envelope-from rrs@repoman.freebsd.org)
Received: (from rrs@localhost)
	by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k8L9thBn069706;
	Thu, 21 Sep 2006 09:55:43 GMT (envelope-from rrs)
Message-Id: <200609210955.k8L9thBn069706@repoman.freebsd.org>
From: Randall Stewart <rrs@FreeBSD.org>
Date: Thu, 21 Sep 2006 09:55:43 +0000 (UTC)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: src/sys/kern uipc_mbuf.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Sep 2006 09:55:47 -0000

rrs         2006-09-21 09:55:43 UTC

  FreeBSD src repository

  Modified files:
    sys/kern             uipc_mbuf.c 
  Log:
  atomic_fetchadd_int is used by mb_free_ext(), but it
  returns the previous value that the "add" effected (In
  this case we are adding -1), afterwhich we compare it
  to '0'... to see if we free the mbuf... we should
  be comparing it to '1'... Note that this only effects
  when there is contention since there is a first part
  to the comparison that checks to see if its '1'. So
  this bug would only crop up if two CPU's are trying
  to free the same mbuf refcount at the same time. This
  will happen in SCTP but I doubt can happen in TCP or
  UDP.
  PR:             N/A
  Submitted by:   rrs
  Reviewed by:    gnn,sam
  Approved by:    gnn,sam
  
  Revision  Changes    Path
  1.167     +1 -1      src/sys/kern/uipc_mbuf.c