netgraph.h:

  Change a prototype.
  Add a function version of ng_ref_node() when debugging so
  a breakpoint can be set on it.
ng_base.c:
  add 'node' as an argument to ng_apply_item so that it is up
  to the caller to take over and release the item's reference on
  the node. If the release reports back that the node went away
  due to the reference going to 0, the caller should cease referencing
  the now defunct node. (e.g. the item was a 'kill node' message).
  Alter ng_unref_node to report back the residual references as a result.
ng_pptpgre.c:
  Don't reference a node after we dropped a reference to it.
  (What if it was the last?)
Fixes a node leak reported by Harti Brandt <brandt@fokus.gmd.de>
 which was due to an incorrect earlier attempt to fix the
 "accessing node after dropping the last reference" problem.

1 files changed, 2 insertions, 1 deletions

diff --git a/sys/netgraph/ng_pptpgre.c b/sys/netgraph/ng_pptpgre.c
index c9a83accd0a4..1a1f6cac9b83 100644
--- a/sys/netgraph/ng_pptpgre.c
+++ b/sys/netgraph/ng_pptpgre.c
@@ -869,8 +869,8 @@ ng_pptpgre_send_ack_timeout(void *arg)
 		splx(s);
 		return;
 	}
-	NG_NODE_UNREF(node);
 	if (a->sackTimerPtr != arg) {	/* timer stopped race condition */
+		NG_NODE_UNREF(node);
 		splx(s);
 		return;
 	}
@@ -878,6 +878,7 @@ ng_pptpgre_send_ack_timeout(void *arg)
 
 	/* Send a frame with an ack but no payload */
   	ng_pptpgre_xmit(node, NULL);
+	NG_NODE_UNREF(node);
 	splx(s);
 }