Permalink
Browse files

fixed a memory leak for an unresolved packet in ND queue

  • Loading branch information...
1 parent 3c622d2 commit 77e37c33aa9ca98a50562f083a78ae9889239354 suz committed Mar 17, 2006
Showing with 27 additions and 15 deletions.
  1. +5 −1 CHANGELOG
  2. +22 −14 kame/sys/netinet6/nd6.c
View
@@ -1,7 +1,11 @@
CHANGELOG for KAME kit
-$KAME: CHANGELOG,v 1.2819 2006/03/15 09:29:50 suz Exp $
+$KAME: CHANGELOG,v 1.2820 2006/03/17 07:23:30 suz Exp $
<200603>
+2006-03-17 SUZUKI, Shinsuke <suz@alaxala.net>
+ * kame/sys/netinet6/nd6.c: fixed a memory leak for an unresolved
+ packet in ND queue
+
2006-03-15 SUZUKI, Shinsuke <suz@alaxala.net>
* kame/sys/netinet6/nd6_rtr.c: implements section 2.2. of
RFC4191, regarding the reserved preference value (10).
@@ -1,4 +1,4 @@
-/* $KAME: nd6.c,v 1.395 2006/02/12 07:16:08 jinmei Exp $ */
+/* $KAME: nd6.c,v 1.396 2006/03/17 07:23:31 suz Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -169,6 +169,7 @@ static void nd6_rtdrain __P((struct rtentry *, struct rttimer *));
#endif
static struct llinfo_nd6 *nd6_free __P((struct rtentry *, int));
static void nd6_llinfo_timer __P((void *));
+static void clear_llinfo_pqueue __P((struct llinfo_nd6 *));
#ifdef __NetBSD__
struct callout nd6_slowtimo_ch = CALLOUT_INITIALIZER;
@@ -605,9 +606,9 @@ nd6_llinfo_timer(arg)
* assuming every packet in ln_hold has the
* same IP header
*/
- ln->ln_hold = NULL;
icmp6_error2(m, ICMP6_DST_UNREACH,
ICMP6_DST_UNREACH_ADDR, 0, rt->rt_ifp);
+ clear_llinfo_pqueue(ln);
}
if (rt)
(void)nd6_free(rt, 0);
@@ -1704,8 +1705,7 @@ nd6_rtrequest(req, rt, info)
nd6_llinfo_settimer(ln, -1);
rt->rt_llinfo = 0;
rt->rt_flags &= ~RTF_LLINFO;
- if (ln->ln_hold)
- m_freem(ln->ln_hold);
+ clear_llinfo_pqueue(ln);
Free((caddr_t)ln);
}
}
@@ -2557,7 +2557,7 @@ nd6_output(ifp, origifp, m0, dst, rt0)
while (i >= nd6_maxqueuelen) {
m_hold = ln->ln_hold;
ln->ln_hold = ln->ln_hold->m_nextpkt;
- m_free(m_hold);
+ m_freem(m_hold);
i--;
}
} else {
@@ -2739,8 +2739,6 @@ void
nd6_drain()
{
struct llinfo_nd6 *ln, *nln;
- int count = 0;
- struct mbuf *mold;
int s;
#if defined(__NetBSD__) || defined(__OpenBSD__)
@@ -2752,17 +2750,27 @@ nd6_drain()
for (ln = llinfo_nd6.ln_next; ln && ln != &llinfo_nd6; ln = nln) {
nln = ln->ln_next;
- mold = ln->ln_hold;
- ln->ln_hold = NULL;
-
- if (mold) {
- m_freem(mold);
- count++;
- }
+ clear_llinfo_pqueue(ln);
}
splx(s);
}
+static void
+clear_llinfo_pqueue(ln)
+ struct llinfo_nd6 *ln;
+{
+ struct mbuf *m_hold, *m_hold_next;
+
+ for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) {
+ m_hold_next = m_hold->m_nextpkt;
+ m_hold->m_nextpkt = NULL;
+ m_freem(m_hold);
+ }
+
+ ln->ln_hold = NULL;
+ return;
+}
+
#ifndef __FreeBSD__
int
nd6_sysctl(name, oldp, oldlenp, newp, newlen)

0 comments on commit 77e37c3

Please sign in to comment.