mmacy 6fcaec6a10 NULL out cc_data in pluggable TCP {cc}_cb_destroy
When ABE was added (rS331214) to NewReno and leak fixed (rS333699) , it now has
a destructor (newreno_cb_destroy) for per connection state. Other congestion
controls may allocate and free cc_data on entry and exit, but the field is
never explicitly NULLed if moving back to NewReno which only internally
allocates stateful data (no entry contstructor) resulting in a situation where
newreno_cb_destory might be called on a junk pointer.

 -    NULL out cc_data in the framework after calling {cc}_cb_destroy
 -    free(9) checks for NULL so there is no need to perform not NULL checks
     before calling free.
 -    Improve a comment about NewReno in tcp_ccalgounload

This is the result of a debugging session from Jason Wolfe, Jason Eggleston,
and mmacy@ and very helpful insight from lstewart@.

Submitted by: Kevin Bowling
Reviewed by: lstewart
Sponsored by: Limelight Networks
Differential Revision: https://reviews.freebsd.org/D16282
2018-07-22 05:37:58 +00:00
..
2018-07-11 14:54:56 +00:00
2017-02-28 23:42:47 +00:00
2018-05-29 12:32:08 +00:00
2018-07-01 08:37:07 +00:00
2018-07-01 08:37:07 +00:00
2018-03-23 16:56:44 +00:00
2018-07-01 08:37:07 +00:00
2018-07-10 08:05:32 +00:00
2018-05-19 05:56:21 +00:00