diff options
| author | glebius <glebius@FreeBSD.org> | 2014-05-05 21:33:20 +0000 |
|---|---|---|
| committer | glebius <glebius@FreeBSD.org> | 2014-05-05 21:33:20 +0000 |
| commit | 9f8ba75695ed7d1985f8027d4fa48535139ead26 (patch) | |
| tree | 2cedc68140e34246f0b3bc226d0b65a170c9e619 | |
| parent | 4c0632abf4649c93dfa12517eeb1f006924d972a (diff) | |
| download | FreeBSD-src-9f8ba75695ed7d1985f8027d4fa48535139ead26.zip FreeBSD-src-9f8ba75695ed7d1985f8027d4fa48535139ead26.tar.gz | |
The tcp_log_addrs() uses th pointer, which points into the mbuf, thus we
can not free the mbuf before tcp_log_addrs().
Sponsored by: Nginx, Inc.
Sponsored by: Netflix
| -rw-r--r-- | sys/netinet/tcp_reass.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c index b0366b2..c8bd4b1 100644 --- a/sys/netinet/tcp_reass.c +++ b/sys/netinet/tcp_reass.c @@ -144,7 +144,6 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m) V_tcp_reass_overflows++; TCPSTAT_INC(tcps_rcvmemdrop); - m_freem(m); *tlenp = 0; if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) { @@ -152,6 +151,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m) "segment dropped\n", s, __func__); free(s, M_TCPLOG); } + m_freem(m); return (0); } |
