svn commit: r348232 - stable/12/sys/netinet6

[Andrey V. Elsukov]

Author: ae
Date: Fri May 24 08:40:37 2019
New Revision: 348232
URL: https://svnweb.freebsd.org/changeset/base/348232

Log:
  MFC r347383:
    In mld_v2_cancel_link_timers() check number of references and disconnect
    inm before releasing the last reference. This fixes possible panics and
    assertion.
  
    PR:		237329
    Reviewed by:	mmacy

Modified:
  stable/12/sys/netinet6/mld6.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet6/mld6.c
==============================================================================
--- stable/12/sys/netinet6/mld6.c	Fri May 24 06:49:47 2019	(r348231)
+++ stable/12/sys/netinet6/mld6.c	Fri May 24 08:40:37 2019	(r348232)
@@ -1704,6 +1704,8 @@ mld_v2_cancel_link_timers(struct mld_ifsoftc *mli)
 			 * version, we need to release the final
 			 * reference held for issuing the INCLUDE {}.
 			 */
+			if (inm->in6m_refcount == 1)
+				in6m_disconnect_locked(&inmh, inm);
 			in6m_rele_locked(&inmh, inm);
 			/* FALLTHROUGH */
 		case MLD_G_QUERY_PENDING_MEMBER: