Author: bz
Date: Sat Aug 14 13:44:24 2010
New Revision: 211296
URL: http://svn.freebsd.org/changeset/base/211296

Log:
  MFC r210686:
  
    MFp4 @181628:
  
    Free the rtentry after we diconnected it from the FIB and are counting
    it as rttrash.  There might still be a chance we leak it from a different
    code path but there is nothing we can do about this here.

Modified:
  stable/8/sys/netinet/in_rmx.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cam/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/e1000/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/netinet/in_rmx.c
==============================================================================
--- stable/8/sys/netinet/in_rmx.c       Sat Aug 14 09:29:42 2010        
(r211295)
+++ stable/8/sys/netinet/in_rmx.c       Sat Aug 14 13:44:24 2010        
(r211296)
@@ -408,14 +408,28 @@ in_ifadownkill(struct radix_node *rn, vo
        if (rt->rt_ifa == ap->ifa &&
            (ap->del || !(rt->rt_flags & RTF_STATIC))) {
                /*
-                * We need to disable the automatic prune that happens
-                * in this case in rtrequest() because it will blow
-                * away the pointers that rn_walktree() needs in order
-                * continue our descent.  We will end up deleting all
-                * the routes that rtrequest() would have in any case,
-                * so that behavior is not needed there.
+                * Aquire a reference so that it can later be freed
+                * as the refcount would be 0 here in case of at least
+                * ap->del.
+                */
+               RT_ADDREF(rt);
+               /*
+                * Disconnect it from the tree and permit protocols
+                * to cleanup.
                 */
                rtexpunge(rt);
+               /*
+                * At this point it is an rttrash node, and in case
+                * the above is the only reference we must free it.
+                * If we do not noone will have a pointer and the
+                * rtentry will be leaked forever.
+                * In case someone else holds a reference, we are
+                * fine as we only decrement the refcount. In that
+                * case if the other entity calls RT_REMREF, we
+                * will still be leaking but at least we tried.
+                */
+               RTFREE_LOCKED(rt);
+               return (0);
        }
        RT_UNLOCK(rt);
        return 0;
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to