MFC r205789:

  When tearing down IPsec as part of a (virtual) network stack,
  do not try to free the same list twice but free both the
  acquiring list and the security policy acquiring list.

  Reviewed by:  anchie

1 files changed, 9 insertions, 7 deletions

diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 99dce21..5d08c9c 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -7787,7 +7787,8 @@ void
 key_destroy(void)
 {
 	struct secpolicy *sp, *nextsp;
-	struct secspacq *acq, *nextacq;
+	struct secacq *acq, *nextacq;
+	struct secspacq *spacq, *nextspacq;
 	struct secashead *sah, *nextsah;
 	struct secreg *reg;
 	int i;
@@ -7828,7 +7829,7 @@ key_destroy(void)
 	REGTREE_UNLOCK();
 
 	ACQ_LOCK();
-	for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) {
+	for (acq = LIST_FIRST(&V_acqtree); acq != NULL; acq = nextacq) {
 		nextacq = LIST_NEXT(acq, chain);
 		if (__LIST_CHAINED(acq)) {
 			LIST_REMOVE(acq, chain);
@@ -7838,11 +7839,12 @@ key_destroy(void)
 	ACQ_UNLOCK();
 
 	SPACQ_LOCK();
-	for (acq = LIST_FIRST(&V_spacqtree); acq != NULL; acq = nextacq) {
-		nextacq = LIST_NEXT(acq, chain);
-		if (__LIST_CHAINED(acq)) {
-			LIST_REMOVE(acq, chain);
-			free(acq, M_IPSEC_SAQ);
+	for (spacq = LIST_FIRST(&V_spacqtree); spacq != NULL;
+	    spacq = nextspacq) {
+		nextspacq = LIST_NEXT(spacq, chain);
+		if (__LIST_CHAINED(spacq)) {
+			LIST_REMOVE(spacq, chain);
+			free(spacq, M_IPSEC_SAQ);
 		}
 	}
 	SPACQ_UNLOCK();