Index: sys/netinet/igmp.c =================================================================== --- sys/netinet/igmp.c +++ sys/netinet/igmp.c @@ -856,6 +856,7 @@ "process v2 query 0x%08x on ifp %p(%s)", ntohl(igmp->igmp_group.s_addr), ifp, ifp->if_xname); igmp_v2_update_group(inm, timer); + inm_release_deferred(inm); } } @@ -1077,6 +1078,7 @@ */ if (igi->igi_v3_timer == 0 || igi->igi_v3_timer >= timer) igmp_input_v3_group_query(inm, igi, timer, igmpv3); + inm_release_deferred(inm); } out_locked: @@ -1296,6 +1298,9 @@ } out_locked: + if (inm) + inm_release_deferred(inm); + IN_MULTI_LIST_UNLOCK(); return (0); @@ -1406,8 +1411,9 @@ break; } } - out_locked: + if (inm) + inm_release_deferred(inm); IN_MULTI_LIST_UNLOCK(); return (0); Index: sys/netinet/in_mcast.c =================================================================== --- sys/netinet/in_mcast.c +++ sys/netinet/in_mcast.c @@ -357,6 +357,8 @@ break; inm = NULL; } + if (inm) + inm_acquire_locked(inm); return (inm); } @@ -564,9 +566,8 @@ * If we already joined this group, just bump the * refcount and return it. */ - KASSERT(inm->inm_refcount >= 1, + KASSERT(inm->inm_refcount > 1, ("%s: bad refcount %d", __func__, inm->inm_refcount)); - inm_acquire_locked(inm); *pinm = inm; } IN_MULTI_LIST_UNLOCK(); @@ -638,7 +639,8 @@ inm->inm_ifp = ifp; inm->inm_igi = ii->ii_igmp; inm->inm_ifma = ifma; - inm->inm_refcount = 1; + /* One reference for the caller and one for the ifp */ + inm->inm_refcount = 2; inm->inm_state = IGMP_NOT_MEMBER; mbufq_init(&inm->inm_scq, IGMP_MAX_STATE_CHANGES); inm->inm_st[0].iss_fmode = MCAST_UNDEFINED; @@ -1314,6 +1316,7 @@ if (error) { CTR2(KTR_IGMPV3, "%s: dropping ref on %p", __func__, inm); + /* drop the callers reference */ inm_release_deferred(inm); } else { *pinm = inm; @@ -2285,7 +2288,6 @@ IN_MULTI_LIST_UNLOCK(); goto out_imo_free; } - inm_acquire(inm); imo->imo_membership[idx] = inm; } else { CTR1(KTR_IGMPV3, "%s: merge inm state", __func__);