git: 4d3cbeb7b407 - main - ng_socket: plug node reference leak

From: Gleb Smirnoff <glebius_at_FreeBSD.org>
Date: Fri, 26 Jun 2026 23:36:13 UTC
The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=4d3cbeb7b407e127a5364f86039745068fbfc61f

commit 4d3cbeb7b407e127a5364f86039745068fbfc61f
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2026-06-26 23:03:14 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2026-06-26 23:35:36 +0000

    ng_socket: plug node reference leak
    
    There is no need to reference node in its constructor, the framework
    already granted us a reference.  This extraneous reference was later given
    back on socket detach.  However, if node is destroyed before the socket,
    the node was leaked.  This leak was harmless until VIMAGE, where
    vnet_netgraph_uninit() would cycle through all nodes and shut them down
    expecting them to not exist after the shutdown.
    
    Fixes: 19284374970533e1aa04020d4f840e8877ed6266
---
 sys/netgraph/ng_socket.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c
index e08027693f32..9dbdc499bb0e 100644
--- a/sys/netgraph/ng_socket.c
+++ b/sys/netgraph/ng_socket.c
@@ -506,7 +506,6 @@ ngc_attach(struct socket *so, int type, struct thread *td)
 
 	/* Link the node and the private data. */
 	NG_NODE_SET_PRIVATE(priv->node, priv);
-	NG_NODE_REF(priv->node);
 	priv->refs++;
 
 	return (0);
@@ -602,7 +601,6 @@ ng_socket_free_priv(struct ngsock *priv)
 
 		priv->node = NULL;
 		mtx_unlock(&priv->mtx);
-		NG_NODE_UNREF(node);
 		ng_rmnode_self(node);
 	} else
 		mtx_unlock(&priv->mtx);