The recent changes to move the ref count increment
back from the end of the function created an issue. If one of the routines returns NULL during setup we have inp's with extra references (which is why the increment was at the end). Also the stack switch return code was being ignored and actually has meaning if the stack cannot take over it should return NULL. Fix both of these situation by being sure to test the return code and of course in any case of return NULL (there are 3) make sure we properly reduce the ref count. Sponsored by: Netflix Inc. Differential Revision: https://reviews.freebsd.org/D25903
This commit is contained in:
parent
d6391a26d6
commit
8315f1ea26
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=363725
@ -1713,6 +1713,7 @@ tcp_newtcpcb(struct inpcb *inp)
|
||||
if (CC_ALGO(tp)->cb_init(tp->ccv) > 0) {
|
||||
if (tp->t_fb->tfb_tcp_fb_fini)
|
||||
(*tp->t_fb->tfb_tcp_fb_fini)(tp, 1);
|
||||
in_pcbrele_wlocked(inp);
|
||||
refcount_release(&tp->t_fb->tfb_refcnt);
|
||||
uma_zfree(V_tcpcb_zone, tm);
|
||||
return (NULL);
|
||||
@ -1723,6 +1724,7 @@ tcp_newtcpcb(struct inpcb *inp)
|
||||
if (khelp_init_osd(HELPER_CLASS_TCP, tp->osd)) {
|
||||
if (tp->t_fb->tfb_tcp_fb_fini)
|
||||
(*tp->t_fb->tfb_tcp_fb_fini)(tp, 1);
|
||||
in_pcbrele_wlocked(inp);
|
||||
refcount_release(&tp->t_fb->tfb_refcnt);
|
||||
uma_zfree(V_tcpcb_zone, tm);
|
||||
return (NULL);
|
||||
@ -1783,7 +1785,12 @@ tcp_newtcpcb(struct inpcb *inp)
|
||||
tcp_log_tcpcbinit(tp);
|
||||
#endif
|
||||
if (tp->t_fb->tfb_tcp_fb_init) {
|
||||
(*tp->t_fb->tfb_tcp_fb_init)(tp);
|
||||
if ((*tp->t_fb->tfb_tcp_fb_init)(tp)) {
|
||||
refcount_release(&tp->t_fb->tfb_refcnt);
|
||||
in_pcbrele_wlocked(inp);
|
||||
uma_zfree(V_tcpcb_zone, tm);
|
||||
return (NULL);
|
||||
}
|
||||
}
|
||||
#ifdef STATS
|
||||
if (V_tcp_perconn_stats_enable == 1)
|
||||
|
Loading…
Reference in New Issue
Block a user