From owner-svn-src-stable@FreeBSD.ORG Thu Mar 7 23:51:08 2013 Return-Path: Delivered-To: svn-src-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 192A4DDE; Thu, 7 Mar 2013 23:51:08 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id CF509B3F; Thu, 7 Mar 2013 23:51:07 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r27Np7kf061012; Thu, 7 Mar 2013 23:51:07 GMT (envelope-from tuexen@svn.freebsd.org) Received: (from tuexen@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r27Np7Bu061007; Thu, 7 Mar 2013 23:51:07 GMT (envelope-from tuexen@svn.freebsd.org) Message-Id: <201303072351.r27Np7Bu061007@svn.freebsd.org> From: Michael Tuexen Date: Thu, 7 Mar 2013 23:51:07 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org Subject: svn commit: r247978 - stable/8/sys/netinet X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 23:51:08 -0000 Author: tuexen Date: Thu Mar 7 23:51:07 2013 New Revision: 247978 URL: http://svnweb.freebsd.org/changeset/base/247978 Log: MFC r238550: Fix a refcount bug when freeing an association. While there: Change code to be consistent. Discussed with rrs@. Modified: stable/8/sys/netinet/sctp_pcb.c stable/8/sys/netinet/sctputil.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/netinet/ (props changed) Modified: stable/8/sys/netinet/sctp_pcb.c ============================================================================== --- stable/8/sys/netinet/sctp_pcb.c Thu Mar 7 23:48:29 2013 (r247977) +++ stable/8/sys/netinet/sctp_pcb.c Thu Mar 7 23:51:07 2013 (r247978) @@ -4872,6 +4872,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, /* now clean up any chunks here */ TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { TAILQ_REMOVE(&outs->outqueue, sp, next); + sctp_free_spbufspace(stcb, asoc, sp); if (sp->data) { if (so) { /* Still an open socket - report */ @@ -4882,19 +4883,14 @@ sctp_free_assoc(struct sctp_inpcb *inp, sctp_m_freem(sp->data); sp->data = NULL; sp->tail_mbuf = NULL; + sp->length = 0; } } if (sp->net) { sctp_free_remote_addr(sp->net); sp->net = NULL; } - sctp_free_spbufspace(stcb, asoc, sp); - if (sp->holds_key_ref) - sctp_auth_key_release(stcb, sp->auth_keyid, SCTP_SO_LOCKED); - /* Free the zone stuff */ - SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_strmoq), sp); - SCTP_DECR_STRMOQ_COUNT(); - /* sa_ignore FREED_MEMORY */ + sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); } } /* sa_ignore FREED_MEMORY */ Modified: stable/8/sys/netinet/sctputil.c ============================================================================== --- stable/8/sys/netinet/sctputil.c Thu Mar 7 23:48:29 2013 (r247977) +++ stable/8/sys/netinet/sctputil.c Thu Mar 7 23:51:07 2013 (r247978) @@ -3774,6 +3774,8 @@ sctp_report_all_outbound(struct sctp_tcb if (sp->data) { sctp_m_freem(sp->data); sp->data = NULL; + sp->tail_mbuf = NULL; + sp->length = 0; } } if (sp->net) { @@ -4833,7 +4835,7 @@ sctp_release_pr_sctp_chunk(struct sctp_t /* * Pull any data to free up the SB * and allow sender to "add more" - * whilc we will throw away :-) + * while we will throw away :-) */ sctp_free_spbufspace(stcb, &stcb->asoc, sp); @@ -4841,9 +4843,9 @@ sctp_release_pr_sctp_chunk(struct sctp_t do_wakeup_routine = 1; sp->some_taken = 1; sctp_m_freem(sp->data); - sp->length = 0; sp->data = NULL; sp->tail_mbuf = NULL; + sp->length = 0; } break; }