svn commit: r265393 - head/sys/netinet

[Gleb Smirnoff]

Author: glebius
Date: Mon May  5 21:33:20 2014
New Revision: 265393
URL: http://svnweb.freebsd.org/changeset/base/265393

Log:
  The tcp_log_addrs() uses th pointer, which points into the mbuf, thus we
  can not free the mbuf before tcp_log_addrs().
  
  Sponsored by:	Nginx, Inc.
  Sponsored by:	Netflix

Modified:
  head/sys/netinet/tcp_reass.c

Modified: head/sys/netinet/tcp_reass.c
==============================================================================
--- head/sys/netinet/tcp_reass.c	Mon May  5 21:31:00 2014	(r265392)
+++ head/sys/netinet/tcp_reass.c	Mon May  5 21:33:20 2014	(r265393)
@@ -144,7 +144,6 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 
 		V_tcp_reass_overflows++;
 		TCPSTAT_INC(tcps_rcvmemdrop);
-		m_freem(m);
 		*tlenp = 0;
 		if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL,
 		    NULL))) {
@@ -152,6 +151,7 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 			    "segment dropped\n", s, __func__);
 			free(s, M_TCPLOG);
 		}
+		m_freem(m);
 		return (0);
 	}