diff options
| author | jhb <jhb@FreeBSD.org> | 2017-02-03 23:48:56 +0000 |
|---|---|---|
| committer | jhb <jhb@FreeBSD.org> | 2017-02-03 23:48:56 +0000 |
| commit | e2f1e57ebf4acaf04684a4f14c865499ab6ff22e (patch) | |
| tree | 6f84d78f6ec3a52bbece55b65eed820a9373d5cd /sys/dev/cxgbe | |
| parent | cc8d4a2c8f424c6ed40fab40706784a5c770654f (diff) | |
| download | FreeBSD-src-e2f1e57ebf4acaf04684a4f14c865499ab6ff22e.zip FreeBSD-src-e2f1e57ebf4acaf04684a4f14c865499ab6ff22e.tar.gz | |
MFC 312904: Don't drop a reference to the TOE PCB in undo_offload_socket().
undo_offload_socket() is only called by t4_connect() during a connection
setup failure, but t4_connect() still owns the TOE PCB and frees ita
after undo_offload_socket() returns. Release a reference in
undo_offload_socket() resulted in a double-free which panicked when
t4_connect() performed the second free. The reference release was
added to undo_offload_socket() incorrectly in r299210.
Sponsored by: Chelsio Communications
Diffstat (limited to 'sys/dev/cxgbe')
| -rw-r--r-- | sys/dev/cxgbe/tom/t4_tom.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/sys/dev/cxgbe/tom/t4_tom.c b/sys/dev/cxgbe/tom/t4_tom.c index 2c6f6e8..11558c2 100644 --- a/sys/dev/cxgbe/tom/t4_tom.c +++ b/sys/dev/cxgbe/tom/t4_tom.c @@ -273,8 +273,6 @@ undo_offload_socket(struct socket *so) mtx_lock(&td->toep_list_lock); TAILQ_REMOVE(&td->toep_list, toep, link); mtx_unlock(&td->toep_list_lock); - - free_toepcb(toep); } static void |
