svn commit: r260707 - head/sys/netinet
Alexander V. Chernikov
melifaro at FreeBSD.org
Thu Jan 16 12:35:19 UTC 2014
Author: melifaro
Date: Thu Jan 16 12:35:18 2014
New Revision: 260707
URL: http://svnweb.freebsd.org/changeset/base/260707
Log:
Fix refcount leak on netinet ifa.
Reviewed by: glebius
MFC after: 2 weeks
Sponsored by: Yandex LLC
Modified:
head/sys/netinet/in.c
Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c Thu Jan 16 12:31:27 2014 (r260706)
+++ head/sys/netinet/in.c Thu Jan 16 12:35:18 2014 (r260707)
@@ -408,7 +408,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t dat
if (ifp->if_flags & IFF_LOOPBACK)
ia->ia_dstaddr = ia->ia_addr;
- ifa_ref(ifa); /* if_addrhead */
+ /* if_addrhead is already referenced by ifa_alloc() */
IF_ADDR_WLOCK(ifp);
TAILQ_INSERT_TAIL(&ifp->if_addrhead, ifa, ifa_link);
IF_ADDR_WUNLOCK(ifp);
@@ -495,13 +495,13 @@ fail1:
IF_ADDR_WLOCK(ifp);
TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
IF_ADDR_WUNLOCK(ifp);
- ifa_free(&ia->ia_ifa);
+ ifa_free(&ia->ia_ifa); /* if_addrhead */
IN_IFADDR_WLOCK();
TAILQ_REMOVE(&V_in_ifaddrhead, ia, ia_link);
LIST_REMOVE(ia, ia_hash);
IN_IFADDR_WUNLOCK();
- ifa_free(&ia->ia_ifa);
+ ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
return (error);
}
@@ -565,7 +565,6 @@ in_difaddr_ioctl(caddr_t data, struct if
TAILQ_REMOVE(&V_in_ifaddrhead, ia, ia_link);
LIST_REMOVE(ia, ia_hash);
IN_IFADDR_WUNLOCK();
- ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
/*
* in_scrubprefix() kills the interface route.
@@ -601,6 +600,7 @@ in_difaddr_ioctl(caddr_t data, struct if
}
EVENTHANDLER_INVOKE(ifaddr_event, ifp);
+ ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
return (0);
}
More information about the svn-src-all
mailing list