Re: kernel: mfree: m->m_nextpkt != NULL

[Noritoshi Demizu]

> What does this Subject mean?

I observed the same message last week.

I think it comes from printf() in m_free() of kern/uipc_mbuf.c.

m_free() has one argument "struct mbuf *m".
This message is printed when m->m_nextpkt != NULL.

> The traceback on the console is going through ip_freef and ip_slowtimo.

Thanks.  Here is an excerpt from netinet/ip_input.c rev 1.58.

  1359: /*
  1360:  * Free a fragment reassembly header and all
  1361:  * associated datagrams.
  1362:  */
  1363: static void
  1364: ip_freef(struct ipq *fp)
  1365: {
  1366:         struct mbuf *q;
  1367:    
  1368:         while (fp->ipq_frags) {
  1369:                 q = fp->ipq_frags;
  1370:                 fp->ipq_frags = q->m_nextpkt;
+                       q->m_nextpkt = NULL;
  1371:                 m_freem(q);
  1372:         }
  1373:         remque(fp);
  1374:         mpipe_free(&ipq_mpipe, fp);
  1375:         nipq--;
  1376: }

m_freem() frees an mbuf chain.  It calls m_free() to free each mbuf.
So, I think q->m_nextpkt should be cleared before calling m_freem().
If we add the line indicated by the '+' sign above, I think this
problem will be fixed.

I will try this modificatioin on Thursday.

Regards,
Noritoshi Demizu