Author: melifaro
Date: Thu Jan 16 12:35:18 2014
New Revision: 260707
URL: http://svnweb.freebsd.org/changeset/base/260707
Log:
Fix refcount leak on netinet ifa.
Reviewed by: glebius
MFC after: 2 weeks
Sponsored by: Yandex LLC
Modified:
head/sys/netinet/in.c
Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c Thu Jan 16 12:31:27 2014 (r260706)
+++ head/sys/netinet/in.c Thu Jan 16 12:35:18 2014 (r260707)
@@ -408,7 +408,7 @@ in_aifaddr_ioctl(u_long cmd, caddr_t dat
if (ifp->if_flags & IFF_LOOPBACK)
ia->ia_dstaddr = ia->ia_addr;
- ifa_ref(ifa); /* if_addrhead */
+ /* if_addrhead is already referenced by ifa_alloc() */
IF_ADDR_WLOCK(ifp);
TAILQ_INSERT_TAIL(&ifp->if_addrhead, ifa, ifa_link);
IF_ADDR_WUNLOCK(ifp);
@@ -495,13 +495,13 @@ fail1:
IF_ADDR_WLOCK(ifp);
TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
IF_ADDR_WUNLOCK(ifp);
- ifa_free(&ia->ia_ifa);
+ ifa_free(&ia->ia_ifa); /* if_addrhead */
IN_IFADDR_WLOCK();
TAILQ_REMOVE(&V_in_ifaddrhead, ia, ia_link);
LIST_REMOVE(ia, ia_hash);
IN_IFADDR_WUNLOCK();
- ifa_free(&ia->ia_ifa);
+ ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
return (error);
}
@@ -565,7 +565,6 @@ in_difaddr_ioctl(caddr_t data, struct if
TAILQ_REMOVE(&V_in_ifaddrhead, ia, ia_link);
LIST_REMOVE(ia, ia_hash);
IN_IFADDR_WUNLOCK();
- ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
/*
* in_scrubprefix() kills the interface route.
@@ -601,6 +600,7 @@ in_difaddr_ioctl(caddr_t data, struct if
}
EVENTHANDLER_INVOKE(ifaddr_event, ifp);
+ ifa_free(&ia->ia_ifa); /* in_ifaddrhead */
return (0);
}
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
