DF-3514 / fix.diff
--- a/sys/netgraph7/netgraph/ng_base.c +++ b/sys/netgraph7/netgraph/ng_base.c @@ -953,9 +953,7 @@ for (i = 0; i <= ng_name_hmask; i++) { LIST_FOREACH_MUTABLE(node, &ng_name_hash[i], nd_nodes, node2) { -#ifdef INVARIANTS LIST_REMOVE(node, nd_nodes); -#endif hash = hash32_str(NG_NODE_NAME(node), HASHINIT) & hmask; LIST_INSERT_HEAD(&new[hash], node, nd_nodes); } @@ -985,15 +983,13 @@ for (i = 0; i <= ng_ID_hmask; i++) { LIST_FOREACH_MUTABLE(node, &ng_ID_hash[i], nd_idnodes, node2) { -#ifdef INVARIANTS LIST_REMOVE(node, nd_idnodes); -#endif hash = (node->nd_ID % (hmask + 1)); LIST_INSERT_HEAD(&new[hash], node, nd_idnodes); } } - hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_name_hmask); + hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_ID_hmask); ng_ID_hash = new; ng_ID_hmask = hmask; } @@ -3265,6 +3261,8 @@ NGI_ARG2(item) = arg2; oitem = callout_arg(c); callout_reset(c, ticks, &ng_callout_trampoline, item); + if (oitem != NULL && oitem != item) + ng_free_item(oitem); return (0); } @@ -3284,11 +3282,12 @@ if ((rval > 0) && (callout_func(c) == &ng_callout_trampoline) && (NGI_NODE(item) == node)) { /* - * We successfully removed it from the queue before it ran - * So now we need to unreference everything that was - * given extra references. (NG_FREE_ITEM does this). + * We successfully removed it from the queue before it ran. + * The item was never sent, so its refcount is zero; free it + * directly (this also drops the node/hook references it + * holds). */ - NG_FREE_ITEM(item); + ng_free_item(item); } callout_set_arg(c, NULL); |