Attachment #200699 for bug #233535

Lines 426-431 Link Here

(-)sys/netinet6/in6_mcast.c (+12 lines)
426	* If we already joined this group, just bump the	426	* If we already joined this group, just bump the
427	* refcount and return it.	427	* refcount and return it.
428	*/	428	*/
		429	hptrace(inm, "check");
429	KASSERT(inm->in6m_refcount >= 1,	430	KASSERT(inm->in6m_refcount >= 1,
430	("%s: bad refcount %d", __func__, inm->in6m_refcount));	431	("%s: bad refcount %d", __func__, inm->in6m_refcount));
431	in6m_acquire_locked(inm);	432	in6m_acquire_locked(inm);
Lines 497-502 Link Here
497	inm->in6m_mli = MLD_IFINFO(ifp);	498	inm->in6m_mli = MLD_IFINFO(ifp);
498	inm->in6m_ifma = ifma;	499	inm->in6m_ifma = ifma;
499	inm->in6m_refcount = 1;	500	inm->in6m_refcount = 1;
		501	hptrace(inm, "set");
500	inm->in6m_state = MLD_NOT_MEMBER;	502	inm->in6m_state = MLD_NOT_MEMBER;
501	mbufq_init(&inm->in6m_scq, MLD_MAX_STATE_CHANGES);	503	mbufq_init(&inm->in6m_scq, MLD_MAX_STATE_CHANGES);
502		504
Lines 527-532 Link Here
527		529
528	CTR2(KTR_MLD, "%s: refcount is %d", __func__, inm->in6m_refcount);	530	CTR2(KTR_MLD, "%s: refcount is %d", __func__, inm->in6m_refcount);
529		531
		532	hptrace(inm, "check");
		533
530	MPASS(inm->in6m_refcount == 0);	534	MPASS(inm->in6m_refcount == 0);
531	CTR2(KTR_MLD, "%s: freeing inm %p", __func__, inm);	535	CTR2(KTR_MLD, "%s: freeing inm %p", __func__, inm);
532		536
Lines 632-637 Link Here
632	i6mm_chain, imm_tmp) {	636	i6mm_chain, imm_tmp) {
633	if (inm == imm->i6mm_maddr) {	637	if (inm == imm->i6mm_maddr) {
634	LIST_REMOVE(imm, i6mm_chain);	638	LIST_REMOVE(imm, i6mm_chain);
		639	inm->in6m_refcount--;
		640	hptrace(inm, "list remove - post dec");
		641	MPASS(inm->in6m_refcount > 0);
635	free(imm, M_IP6MADDR);	642	free(imm, M_IP6MADDR);
636	}	643	}
637	}	644	}
Lines 646-651 Link Here
646	IN6_MULTI_LIST_LOCK_ASSERT();	653	IN6_MULTI_LIST_LOCK_ASSERT();
647	KASSERT(inm->in6m_refcount > 0, ("refcount == %d inm: %p", inm->in6m_refcount, inm));	654	KASSERT(inm->in6m_refcount > 0, ("refcount == %d inm: %p", inm->in6m_refcount, inm));
648	if (--inm->in6m_refcount == 0) {	655	if (--inm->in6m_refcount == 0) {
		656	hptrace(inm, "list release - post dec");
649	MPASS(inm->in6m_ifp == NULL);	657	MPASS(inm->in6m_ifp == NULL);
650	SLIST_INIT(&tmp);	658	SLIST_INIT(&tmp);
651	inm->in6m_ifma->ifma_protospec = NULL;	659	inm->in6m_ifma->ifma_protospec = NULL;
Lines 652-657 Link Here
652	MPASS(inm->in6m_ifma->ifma_llifma == NULL);	660	MPASS(inm->in6m_ifma->ifma_llifma == NULL);
653	SLIST_INSERT_HEAD(&tmp, inm, in6m_nrele);	661	SLIST_INSERT_HEAD(&tmp, inm, in6m_nrele);
654	in6m_release_list_deferred(&tmp);	662	in6m_release_list_deferred(&tmp);
		663	} else {
		664	hptrace(inm, "list release - post dec");
655	}	665	}
656	}	666	}
657		667
Lines 1413-1418 Link Here
1413	CTR2(KTR_MLD, "%s: dropping ref on %p", __func__, inm);	1423	CTR2(KTR_MLD, "%s: dropping ref on %p", __func__, inm);
1414	if (ifp)	1424	if (ifp)
1415	IF_ADDR_WLOCK(ifp);	1425	IF_ADDR_WLOCK(ifp);
		1426
		1427	hptrace(inm, "leavegroup check");
1416	if (inm->in6m_refcount == 1 && inm->in6m_ifp != NULL)	1428	if (inm->in6m_refcount == 1 && inm->in6m_ifp != NULL)
1417	in6m_disconnect(inm);	1429	in6m_disconnect(inm);
1418	in6m_release_deferred(inm);	1430	in6m_release_deferred(inm);

Lines 760-765 Link Here

(-)sys/netinet6/in6_var.h (+13 lines)
760	return (inm);	760	return (inm);
761	}	761	}
762		762
		763	#include <sys/kdb.h>
		764
		765	static inline void
		766	hptrace(struct in6_multi inm, const char msg)
		767	{
		768	printf("%s - inm=%p - in6m_refcount = %d\n", msg, inm, inm->in6m_refcount);
		769	kdb_backtrace();
		770	}
		771
763	/* Acquire an in6_multi record. */	772	/* Acquire an in6_multi record. */
764	static __inline void	773	static __inline void
765	in6m_acquire_locked(struct in6_multi *inm)	774	in6m_acquire_locked(struct in6_multi *inm)
Lines 767-772 Link Here
767		776
768	IN6_MULTI_LIST_LOCK_ASSERT();	777	IN6_MULTI_LIST_LOCK_ASSERT();
769	++inm->in6m_refcount;	778	++inm->in6m_refcount;
		779	hptrace(inm, "acquire_locked - post inc");
770	}	780	}
771		781
772	static __inline void	782	static __inline void
Lines 784-793 Link Here
784	IN6_MULTI_LIST_LOCK_ASSERT();	794	IN6_MULTI_LIST_LOCK_ASSERT();
785		795
786	if (--inm->in6m_refcount == 0) {	796	if (--inm->in6m_refcount == 0) {
		797	hptrace(inm, "rele_locked - post dec");
787	MPASS(inm->in6m_ifp == NULL);	798	MPASS(inm->in6m_ifp == NULL);
788	inm->in6m_ifma->ifma_protospec = NULL;	799	inm->in6m_ifma->ifma_protospec = NULL;
789	MPASS(inm->in6m_ifma->ifma_llifma == NULL);	800	MPASS(inm->in6m_ifma->ifma_llifma == NULL);
790	SLIST_INSERT_HEAD(inmh, inm, in6m_nrele);	801	SLIST_INSERT_HEAD(inmh, inm, in6m_nrele);
		802	} else {
		803	hptrace(inm, "rele_locked - post dec");
791	}	804	}
792	}	805	}
793		806

Lines 1895-1900 Link Here

(-)sys/netinet6/mld6.c (+10 lines)
1895	error = 0;	1895	error = 0;
1896		1896
1897	/*	1897	/*
		1898	* Check if the in6_multi has already been disconnected.
		1899	*/
		1900	if (inm->in6m_ifp == NULL) {
		1901	CTR3(KTR_MLD, "%s: inm is disconnected", __func__);
		1902	return (0);
		1903	}
		1904
		1905	/*
1898	* Try to detect if the upper layer just asked us to change state	1906	* Try to detect if the upper layer just asked us to change state
1899	* for an interface which has now gone away.	1907	* for an interface which has now gone away.
1900	*/	1908	*/
Lines 2004-2009 Link Here
2004	if (mli->mli_version == MLD_VERSION_2 &&	2012	if (mli->mli_version == MLD_VERSION_2 &&
2005	inm->in6m_state == MLD_LEAVING_MEMBER) {	2013	inm->in6m_state == MLD_LEAVING_MEMBER) {
2006	inm->in6m_refcount--;	2014	inm->in6m_refcount--;
		2015	hptrace(inm, "leaving member - post dec");
		2016	MPASS(inm->in6m_refcount > 0);
2007	}	2017	}
2008	inm->in6m_state = MLD_REPORTING_MEMBER;	2018	inm->in6m_state = MLD_REPORTING_MEMBER;
2009		2019

Return to bug 233535