Re: CVS commit: syssrc/sys/netinet6

[YAMAMOTO Takashi <yamt%mwd.biglobe.ne.jp@localhost>]

From: Bill Studenmund <wrstuden%netbsd.org@localhost>
Subject: Re: CVS commit: syssrc/sys/netinet6
Date: Fri, 10 May 2002 08:17:27 -0700 (PDT)
> On Fri, 10 May 2002, Jun-ichiro itojun Hagino wrote:

> > Log Message:
> > disable ipsec policy caching on pcb, as it seems that there's some 
> > reference-
> > counting mistake that causes panic - see PR 15953 and 13813.
> >
> > i am unable to find the real cause of problem, so it is a shortterm 
> > workaround,
> > hopefully.
> 
> I looked into this at one point. One thing that would probably help is to
> add a macro for increasing the reference count. That way we can easily
> instrument checks on refrence adding in addition to reference releaseing.
> Tests like make sure we aren't about to overflow or we aren't adding a
> reference to something with 0 references.


I think this patch fix the problem.

---
YAMAMOTO Takashi<yamt%mwd.biglobe.ne.jp@localhost>

Index: key.c
===================================================================
RCS file: /cvs/cvsroot/syssrc/sys/netkey/key.c,v
retrieving revision 1.60
diff -u -p -r1.60 key.c
--- key.c       2002/03/21 02:27:50     1.60
+++ key.c       2002/05/10 19:59:40
@@ -961,10 +961,8 @@ key_delsp(sp)
        if (sp == NULL)
                panic("key_delsp: NULL pointer is passed.\n");
 
-       sp->state = IPSEC_SPSTATE_DEAD;
-
        if (sp->refcnt > 0)
-               return; /* can't free */
+               panic("key_delsp: refcnt > 0");
 
        s = splsoftnet();       /*called from softclock()*/
        /* remove from SP index */
@@ -1558,6 +1556,7 @@ key_spdadd(so, m, mhp)
                if (newsp) {
                        newsp->state = IPSEC_SPSTATE_DEAD;
                        key_freesp(newsp);
+                       key_freesp(newsp);
                }
        } else {
                if (newsp != NULL) {
@@ -1778,6 +1777,7 @@ key_spddelete(so, m, mhp)
 
        sp->state = IPSEC_SPSTATE_DEAD;
        key_freesp(sp);
+       key_freesp(sp);
 
        /* invalidate all cached SPD pointers on pcb */
        ipsec_invalpcbcacheall();
@@ -1843,6 +1843,7 @@ key_spddelete2(so, m, mhp)
 
        sp->state = IPSEC_SPSTATE_DEAD;
        key_freesp(sp);
+       key_freesp(sp);
 
        /* invalidate all cached SPD pointers on pcb */
        ipsec_invalpcbcacheall();
@@ -2051,8 +2052,16 @@ key_spdflush(so, m, mhp)
                return key_senderror(so, m, EINVAL);
 
        for (dir = 0; dir < IPSEC_DIR_MAX; dir++) {
-               LIST_FOREACH(sp, &sptree[dir], chain) {
+               struct secpolicy *nextsp;
+
+               for (sp = LIST_FIRST(&sptree[dir]);
+                        sp;
+                        sp = nextsp) {
+                       nextsp = LIST_NEXT(sp, chain);
+                       if (sp->state == IPSEC_SPSTATE_DEAD)
+                               continue;
                        sp->state = IPSEC_SPSTATE_DEAD;
+                       key_freesp(sp);
                }
        }
 
@@ -3842,7 +3851,7 @@ void
 key_timehandler(arg)
        void *arg;
 {
-       u_int dir;
+/*     u_int dir; */
        int s;
        struct timeval tv;
 
@@ -3850,6 +3859,7 @@ key_timehandler(arg)
 
        s = splsoftnet();       /*called from softclock()*/
 
+#if 0
        /* SPD */
     {
        struct secpolicy *sp, *nextsp;
@@ -3866,6 +3876,7 @@ key_timehandler(arg)
                }
        }
     }
+#endif
 
        /* SAD */
     {