d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't drop a reference to the TOE PCB in undo_offload_socket().

Browse Source 
undo_offload_socket() is only called by t4_connect() during a connection
setup failure, but t4_connect() still owns the TOE PCB and frees ita
after undo_offload_socket() returns.  Release a reference in
undo_offload_socket() resulted in a double-free which panicked when
t4_connect() performed the second free.  The reference release was
added to undo_offload_socket() incorrectly in r299210.

MFC after:	1 week
Sponsored by:	Chelsio Communications
This commit is contained in:
John Baldwin 2017-01-27 23:03:28 +00:00
parent 96eeabefbe
commit b67915014d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=312904
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/dev/cxgbe/tom/t4_tom.c
View File

@ -273,8 +273,6 @@ undo_offload_socket(struct socket *so)
mtx_lock(&td->toep_list_lock);
TAILQ_REMOVE(&td->toep_list, toep, link);
mtx_unlock(&td->toep_list_lock);
free_toepcb(toep);
}
static void