svn commit: r347383 - head/sys/netinet6

[Andrey V. Elsukov]

Author: ae
Date: Thu May  9 07:57:33 2019
New Revision: 347383
URL: https://svnweb.freebsd.org/changeset/base/347383

Log:
  In mld_v2_cancel_link_timers() check number of references and disconnect
  inm before releasing the last reference. This fixes possible panics and
  assertion.
  
  PR:		237329
  Reviewed by:	mmacy
  MFC after:	2 weeks

Modified:
  head/sys/netinet6/mld6.c

Modified: head/sys/netinet6/mld6.c
==============================================================================
--- head/sys/netinet6/mld6.c	Thu May  9 07:34:15 2019	(r347382)
+++ head/sys/netinet6/mld6.c	Thu May  9 07:57:33 2019	(r347383)
@@ -1708,6 +1708,8 @@ mld_v2_cancel_link_timers(struct mld_ifsoftc *mli)
 			 * version, we need to release the final
 			 * reference held for issuing the INCLUDE {}.
 			 */
+			if (inm->in6m_refcount == 1)
+				in6m_disconnect_locked(&inmh, inm);
 			in6m_rele_locked(&inmh, inm);
 			/* FALLTHROUGH */
 		case MLD_G_QUERY_PENDING_MEMBER: