Since svc_[dg|vc|tli|tp]_create() did not hold a reference count on the

SVCXPTR structure returned by them, it was possible for the structure
to be free'd before svc_reg() had been completed using the structure.
This patch acquires a reference count on the newly created structure
that is returned by svc_[dg|vc|tli|tp]_create(). It also
adds the appropriate SVC_RELEASE() calls to the callers, except the
experimental nfs subsystem. The latter will be committed separately.

Submitted by:	dfr
Tested by:	pho
Approved by:	kib (mentor)

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/rpc/svc.c b/sys/rpc/svc.c
index 8c3bd2c96292..a59489457f61 100644
--- a/sys/rpc/svc.c
+++ b/sys/rpc/svc.c
@@ -276,6 +276,7 @@ xprt_register(SVCXPRT *xprt)
 {
 	SVCPOOL *pool = xprt->xp_pool;
 
+	SVC_ACQUIRE(xprt);
 	mtx_lock(&pool->sp_lock);
 	xprt->xp_registered = TRUE;
 	xprt->xp_active = FALSE;