# HG changeset patch
# Parent 255ff64fac23144f6a92eb86cd8456254c8d8ea9

diff -r 255ff64fac23 sys/netinet/tcp_reass.c
--- a/sys/netinet/tcp_reass.c	Tue Sep 21 17:52:42 2010 +1000
+++ b/sys/netinet/tcp_reass.c	Fri Sep 24 17:31:34 2010 +1000
@@ -83,7 +83,8 @@
     &VNET_NAME(tcp_reass_maxseg), 0,
     "Global maximum number of TCP Segments in Reassembly Queue");
 
-VNET_DEFINE(int, tcp_reass_qsize) = 0;
+static VNET_DEFINE(int, tcp_reass_qsize) = 0;
+#define	V_tcp_reass_qsize		VNET(tcp_reass_qsize)
 SYSCTL_VNET_INT(_net_inet_tcp_reass, OID_AUTO, cursegments, CTLFLAG_RD,
     &VNET_NAME(tcp_reass_qsize), 0,
     "Global number of TCP Segments currently in Reassembly Queue");
@@ -100,6 +101,9 @@
     &VNET_NAME(tcp_reass_overflows), 0,
     "Global number of TCP Segment Reassembly Queue Overflows");
 
+static VNET_DEFINE(uma_zone_t, tcp_reass_zone);
+#define	V_tcp_reass_zone		VNET(tcp_reass_zone)
+
 /* Initialize TCP reassembly queue */
 static void
 tcp_reass_zone_change(void *tag)
@@ -109,8 +113,6 @@
 	uma_zone_set_max(V_tcp_reass_zone, V_tcp_reass_maxseg);
 }
 
-VNET_DEFINE(uma_zone_t, tcp_reass_zone);
-
 void
 tcp_reass_init(void)
 {
@@ -134,6 +136,26 @@
 }
 #endif
 
+void
+tcp_reass_flush(struct tcpcb *tp)
+{
+	struct tseg_qent *qe;
+
+	INP_WLOCK_ASSERT(tp->t_inpcb);
+
+	while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) {
+		LIST_REMOVE(qe, tqe_q);
+		m_freem(qe->tqe_m);
+		uma_zfree(V_tcp_reass_zone, qe);
+		tp->t_segqlen--;
+		V_tcp_reass_qsize--;
+	}
+
+	KASSERT((tp->t_segqlen == 0),
+	    ("TCP reass queue %p segment count is %d instead of 0 after flush.",
+	    tp, tp->t_segqlen));
+}
+
 int
 tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
 {
diff -r 255ff64fac23 sys/netinet/tcp_subr.c
--- a/sys/netinet/tcp_subr.c	Tue Sep 21 17:52:42 2010 +1000
+++ b/sys/netinet/tcp_subr.c	Fri Sep 24 17:31:34 2010 +1000
@@ -714,7 +714,6 @@
 void
 tcp_discardcb(struct tcpcb *tp)
 {
-	struct tseg_qent *q;
 	struct inpcb *inp = tp->t_inpcb;
 	struct socket *so = inp->inp_socket;
 #ifdef INET6
@@ -801,13 +800,7 @@
 	}
 
 	/* free the reassembly queue, if any */
-	while ((q = LIST_FIRST(&tp->t_segq)) != NULL) {
-		LIST_REMOVE(q, tqe_q);
-		m_freem(q->tqe_m);
-		uma_zfree(V_tcp_reass_zone, q);
-		tp->t_segqlen--;
-		V_tcp_reass_qsize--;
-	}
+	tcp_reass_flush(tp);
 	/* Disconnect offload device, if any. */
 	tcp_offload_detach(tp);
 		
@@ -865,7 +858,6 @@
 		CURVNET_SET(vnet_iter);
 		struct inpcb *inpb;
 		struct tcpcb *tcpb;
-		struct tseg_qent *te;
 
 	/*
 	 * Walk the tcpbs, if existing, and flush the reassembly queue,
@@ -881,14 +873,7 @@
 				continue;
 			INP_WLOCK(inpb);
 			if ((tcpb = intotcpcb(inpb)) != NULL) {
-				while ((te = LIST_FIRST(&tcpb->t_segq))
-			            != NULL) {
-					LIST_REMOVE(te, tqe_q);
-					m_freem(te->tqe_m);
-					uma_zfree(V_tcp_reass_zone, te);
-					tcpb->t_segqlen--;
-					V_tcp_reass_qsize--;
-				}
+				tcp_reass_flush(tcpb);
 				tcp_clean_sackreport(tcpb);
 			}
 			INP_WUNLOCK(inpb);
diff -r 255ff64fac23 sys/netinet/tcp_var.h
--- a/sys/netinet/tcp_var.h	Tue Sep 21 17:52:42 2010 +1000
+++ b/sys/netinet/tcp_var.h	Fri Sep 24 17:31:34 2010 +1000
@@ -44,10 +44,6 @@
 VNET_DECLARE(int, tcp_do_rfc1323);
 #define	V_tcp_do_rfc1323	VNET(tcp_do_rfc1323)
 
-VNET_DECLARE(int, tcp_reass_qsize);
-VNET_DECLARE(struct uma_zone *, tcp_reass_zone);
-#define	V_tcp_reass_qsize	VNET(tcp_reass_qsize)
-#define	V_tcp_reass_zone	VNET(tcp_reass_zone)
 #endif /* _KERNEL */
 
 /* TCP segment queue entry */
@@ -617,6 +613,7 @@
 	    const void *);
 int	 tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *);
 void	 tcp_reass_init(void);
+void	 tcp_reass_flush(struct tcpcb *);
 #ifdef VIMAGE
 void	 tcp_reass_destroy(void);
 #endif