handles new uba stuff and fix page freeing problem
[unix-history] / usr / src / sys / netinet / tcp_input.c
index d62538d..8b26a8a 100644 (file)
@@ -1,4 +1,4 @@
-/*     tcp_input.c     1.44    81/12/22        */
+/*     tcp_input.c     1.52    82/02/03        */
 
 #include "../h/param.h"
 #include "../h/systm.h"
 
 #include "../h/param.h"
 #include "../h/systm.h"
@@ -25,6 +25,7 @@ int   tcpprintfs = 0;
 int    tcpcksum = 1;
 struct sockaddr_in tcp_in = { AF_INET };
 struct tcpiphdr tcp_saveti;
 int    tcpcksum = 1;
 struct sockaddr_in tcp_in = { AF_INET };
 struct tcpiphdr tcp_saveti;
+extern tcpnodelack;
 
 struct tcpcb *tcp_newtcpcb();
 /*
 
 struct tcpcb *tcp_newtcpcb();
 /*
@@ -37,8 +38,9 @@ tcp_input(m0)
        register struct tcpiphdr *ti;
        struct inpcb *inp;
        register struct mbuf *m;
        register struct tcpiphdr *ti;
        struct inpcb *inp;
        register struct mbuf *m;
+       struct mbuf *om = 0;
        int len, tlen, off;
        int len, tlen, off;
-       register struct tcpcb *tp;
+       register struct tcpcb *tp = 0;
        register int tiflags;
        struct socket *so;
        int todrop, acked;
        register int tiflags;
        struct socket *so;
        int todrop, acked;
@@ -53,10 +55,10 @@ COUNT(TCP_INPUT);
        ti = mtod(m, struct tcpiphdr *);
        if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
                ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
        ti = mtod(m, struct tcpiphdr *);
        if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
                ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
-       if (m->m_len < sizeof (struct tcpiphdr)) {
-               if (m_pullup(m, sizeof (struct tcpiphdr)) == 0) {
+       if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
+               if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
                        tcpstat.tcps_hdrops++;
                        tcpstat.tcps_hdrops++;
-                       goto drop;
+                       return;
                }
                ti = mtod(m, struct tcpiphdr *);
        }
                }
                ti = mtod(m, struct tcpiphdr *);
        }
@@ -82,7 +84,7 @@ COUNT(TCP_INPUT);
 
        /*
         * Check that TCP offset makes sense,
 
        /*
         * Check that TCP offset makes sense,
-        * process TCP options and adjust length.
+        * pull out TCP options and adjust length.
         */
        off = ti->ti_off << 2;
        if (off < sizeof (struct tcphdr) || off > tlen) {
         */
        off = ti->ti_off << 2;
        if (off < sizeof (struct tcphdr) || off > tlen) {
@@ -90,10 +92,23 @@ COUNT(TCP_INPUT);
                goto drop;
        }
        ti->ti_len = tlen - off;
                goto drop;
        }
        ti->ti_len = tlen - off;
-#if 0
-       if (off > sizeof (struct tcphdr))
-               tcp_options(ti);
-#endif
+       if (off > sizeof (struct tcphdr)) {
+               if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
+                       tcpstat.tcps_hdrops++;
+                       goto drop;
+               }
+               ti = mtod(m, struct tcpiphdr *);
+               om = m_get(M_DONTWAIT);
+               if (om == 0)
+                       goto drop;
+               om->m_off = MMINOFF;
+               om->m_len = off - sizeof (struct tcphdr);
+               { caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
+                 bcopy(op, mtod(om, caddr_t), om->m_len);
+                 m->m_len -= om->m_len;
+                 bcopy(op+om->m_len, op, m->m_len-sizeof (struct tcpiphdr));
+               }
+       }
        tiflags = ti->ti_flags;
 
 #if vax
        tiflags = ti->ti_flags;
 
 #if vax
@@ -134,6 +149,14 @@ COUNT(TCP_INPUT);
        tp->t_idle = 0;
        tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
 
        tp->t_idle = 0;
        tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
 
+       /*
+        * Process options.
+        */
+       if (om) {
+               tcp_dooptions(tp, om);
+               om = 0;
+       }
+
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
@@ -206,12 +229,15 @@ COUNT(TCP_INPUT);
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                tp->snd_una = ti->ti_ack;
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                tp->snd_una = ti->ti_ack;
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
                tp->t_timer[TCPT_REXMT] = 0;
                tp->irs = ti->ti_seq;
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
                if (SEQ_GT(tp->snd_una, tp->iss)) {
                tp->t_timer[TCPT_REXMT] = 0;
                tp->irs = ti->ti_seq;
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
                if (SEQ_GT(tp->snd_una, tp->iss)) {
-                       so->so_state |= SS_CONNAWAITING;
+                       if (so->so_options & SO_ACCEPTCONN)
+                               so->so_state |= SS_CONNAWAITING;
                        soisconnected(so);
                        tp->t_state = TCPS_ESTABLISHED;
                        (void) tcp_reass(tp, (struct tcpiphdr *)0);
                        soisconnected(so);
                        tp->t_state = TCPS_ESTABLISHED;
                        (void) tcp_reass(tp, (struct tcpiphdr *)0);
@@ -250,6 +276,7 @@ trimthenstep6:
                if (tp->rcv_nxt != ti->ti_seq)
                        goto dropafterack;
                if (ti->ti_len > 0) {
                if (tp->rcv_nxt != ti->ti_seq)
                        goto dropafterack;
                if (ti->ti_len > 0) {
+                       m_adj(m, ti->ti_len);
                        ti->ti_len = 0;
                        ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
                        ti->ti_len = 0;
                        ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
@@ -258,10 +285,11 @@ trimthenstep6:
                 * If segment begins before rcv_nxt, drop leading
                 * data (and SYN); if nothing left, just ack.
                 */
                 * If segment begins before rcv_nxt, drop leading
                 * data (and SYN); if nothing left, just ack.
                 */
-               if (SEQ_GT(tp->rcv_nxt, ti->ti_seq)) {
-                       todrop = tp->rcv_nxt - ti->ti_seq;
+               todrop = tp->rcv_nxt - ti->ti_seq;
+               if (todrop > 0) {
                        if (tiflags & TH_SYN) {
                                tiflags &= ~TH_SYN;
                        if (tiflags & TH_SYN) {
                                tiflags &= ~TH_SYN;
+                               ti->ti_flags &= ~TH_SYN;
                                ti->ti_seq++;
                                if (ti->ti_urp > 1) 
                                        ti->ti_urp--;
                                ti->ti_seq++;
                                if (ti->ti_urp > 1) 
                                        ti->ti_urp--;
@@ -278,19 +306,16 @@ trimthenstep6:
                                ti->ti_urp -= todrop;
                        else {
                                tiflags &= ~TH_URG;
                                ti->ti_urp -= todrop;
                        else {
                                tiflags &= ~TH_URG;
-                               /* ti->ti_flags &= ~TH_URG; */
-                               /* ti->ti_urp = 0; */
+                               ti->ti_flags &= ~TH_URG;
+                               ti->ti_urp = 0;
                        }
                        }
-                       /* tiflags &= ~TH_SYN; */
-                       /* ti->ti_flags &= ~TH_SYN; */
                }
                /*
                 * If segment ends after window, drop trailing data
                 * (and PUSH and FIN); if nothing left, just ACK.
                 */
                }
                /*
                 * If segment ends after window, drop trailing data
                 * (and PUSH and FIN); if nothing left, just ACK.
                 */
-               if (SEQ_GT(ti->ti_seq+ti->ti_len, tp->rcv_nxt+tp->rcv_wnd)) {
-                       todrop =
-                            ti->ti_seq+ti->ti_len - (tp->rcv_nxt+tp->rcv_wnd);
+               todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
+               if (todrop > 0) {
                        if (todrop > ti->ti_len)
                                goto dropafterack;
                        m_adj(m, -todrop);
                        if (todrop > ti->ti_len)
                                goto dropafterack;
                        m_adj(m, -todrop);
@@ -368,8 +393,11 @@ trimthenstep6:
                    SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropwithreset;
                tp->snd_una++;                  /* SYN acked */
                    SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropwithreset;
                tp->snd_una++;                  /* SYN acked */
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
                tp->t_timer[TCPT_REXMT] = 0;
                tp->t_timer[TCPT_REXMT] = 0;
-               so->so_state |= SS_CONNAWAITING;
+               if (so->so_options & SO_ACCEPTCONN)
+                       so->so_state |= SS_CONNAWAITING;
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
                (void) tcp_reass(tp, (struct tcpiphdr *)0);
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
                (void) tcp_reass(tp, (struct tcpiphdr *)0);
@@ -398,26 +426,27 @@ trimthenstep6:
                if (SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropafterack;
                acked = ti->ti_ack - tp->snd_una;
                if (SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropafterack;
                acked = ti->ti_ack - tp->snd_una;
-               if (acked >= so->so_snd.sb_cc) {
-                       acked -= so->so_snd.sb_cc;
-                       tp->snd_wnd -= so->so_snd.sb_cc;
-                       /* if acked > 0 our FIN is acked */
-                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
+               if (ti->ti_ack == tp->snd_max)
                        tp->t_timer[TCPT_REXMT] = 0;
                        tp->t_timer[TCPT_REXMT] = 0;
-               } else {
-                       if (acked) {
-                               sbdrop(&so->so_snd, acked);
-                               tp->snd_wnd -= acked;
-                               acked = 0;
-                       }
+               else {
                        TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
                            tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
                        tp->t_rtt = 0;
                        tp->t_rxtshift = 0;
                }
                        TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
                            tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
                        tp->t_rtt = 0;
                        tp->t_rxtshift = 0;
                }
+               if (acked > so->so_snd.sb_cc) {
+                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
+                       tp->snd_wnd -= so->so_snd.sb_cc;
+               } else {
+                       sbdrop(&so->so_snd.sb_cc, acked);
+                       tp->snd_wnd -= acked;
+                       acked = 0;
+               }
                if (so->so_snd.sb_flags & SB_WAIT)
                        sowwakeup(so);
                tp->snd_una = ti->ti_ack;
                if (so->so_snd.sb_flags & SB_WAIT)
                        sowwakeup(so);
                tp->snd_una = ti->ti_ack;
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
 
                /*
                 * If transmit timer is running and timed sequence
 
                /*
                 * If transmit timer is running and timed sequence
@@ -488,8 +517,11 @@ step6:
         * Update window information.
         */
        if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
         * Update window information.
         */
        if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
-           (SEQ_LEQ(tp->snd_wl2, ti->ti_ack) ||
+           (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
             tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
             tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
+/*
+printf("wl1 %x seq %x wl2 %x ack %x win %x wnd %x\n", tp->snd_wl1, ti->ti_seq, tp->snd_wl2, ti->ti_ack, ti->ti_win, tp->snd_wnd);
+*/
                tp->snd_wnd = ti->ti_win;
                tp->snd_wl1 = ti->ti_seq;
                tp->snd_wl2 = ti->ti_ack;
                tp->snd_wnd = ti->ti_win;
                tp->snd_wl1 = ti->ti_seq;
                tp->snd_wl2 = ti->ti_ack;
@@ -498,20 +530,38 @@ step6:
        }
 
        /*
        }
 
        /*
-        * If an URG bit is set in the segment and is greater than the
-        * current known urgent pointer, then signal the user that the
-        * remote side has out of band data.  This should not happen
-        * in CLOSE_WAIT, CLOSING, LAST-ACK or TIME_WAIT STATES since
-        * a FIN has been received from the remote side.  In these states
-        * we ignore the URG.
+        * Process segments with URG.
         */
         */
-       if ((tiflags & TH_URG) == 0 && TCPS_HAVERCVDFIN(tp->t_state) == 0)
-               if (SEQ_GT(ti->ti_urp, tp->rcv_up)) {
-                       tp->rcv_up = ti->ti_urp;
-#if 0
-                       sohasoutofband(so);             /* XXX */
+       if ((tiflags & TH_URG) && TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+               /*
+                * If this segment advances the known urgent pointer,
+                * then mark the data stream.  This should not happen
+                * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
+                * a FIN has been received from the remote side. 
+                * In these states we ignore the URG.
+                */
+               if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
+                       tp->rcv_up = ti->ti_seq + ti->ti_urp;
+                       so->so_oobmark = so->so_rcv.sb_cc +
+                           (tp->rcv_up - tp->rcv_nxt) - 1;
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+#ifdef TCPTRUEOOB
+                       if ((tp->t_flags & TF_DOOOB) == 0)
 #endif
 #endif
+                               sohasoutofband(so);
+                       tp->t_oobflags &= ~TCPOOB_HAVEDATA;
                }
                }
+               /*
+                * Remove out of band data so doesn't get presented to user.
+                * This can happen independent of advancing the URG pointer,
+                * but if two URG's are pending at once, some out-of-band
+                * data may creep in... ick.
+                */
+               if (ti->ti_urp <= ti->ti_len) {
+                       tcp_pulloutofband(so, ti);
+               }
+       }
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
@@ -527,10 +577,10 @@ step6:
                m->m_off += off;
                m->m_len -= off;
                tiflags = tcp_reass(tp, ti);
                m->m_off += off;
                m->m_len -= off;
                tiflags = tcp_reass(tp, ti);
-{ extern tcpdelack; 
-if (tcpdelack) tp->t_flags |= TF_DELACK; else
-               tp->t_flags |= TF_ACKNOW;               /* XXX TF_DELACK */
-}
+               if (tcpnodelack == 0)
+                       tp->t_flags |= TF_DELACK;
+               else
+                       tp->t_flags |= TF_ACKNOW;
        } else {
                m_freem(m);
                tiflags &= ~TH_FIN;
        } else {
                m_freem(m);
                tiflags &= ~TH_FIN;
@@ -601,10 +651,12 @@ dropafterack:
         */
        if (tiflags & TH_RST)
                goto drop;
         */
        if (tiflags & TH_RST)
                goto drop;
-       tcp_respond(ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+       tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
        return;
 
 dropwithreset:
        return;
 
 dropwithreset:
+       if (om)
+               m_free(om);
        /*
         * Generate a RST, dropping incoming segment.
         * Make ACK acceptable to originator of segment.
        /*
         * Generate a RST, dropping incoming segment.
         * Make ACK acceptable to originator of segment.
@@ -612,11 +664,11 @@ dropwithreset:
        if (tiflags & TH_RST)
                goto drop;
        if (tiflags & TH_ACK)
        if (tiflags & TH_RST)
                goto drop;
        if (tiflags & TH_ACK)
-               tcp_respond(ti, (tcp_seq)0, ti->ti_ack, TH_RST);
+               tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
-               tcp_respond(ti, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK);
+               tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK);
        }
        return;
 
        }
        return;
 
@@ -628,6 +680,126 @@ drop:
        return;
 }
 
        return;
 }
 
+tcp_dooptions(tp, om)
+       struct tcpcb *tp;
+       struct mbuf *om;
+{
+       register u_char *cp;
+       int opt, optlen, cnt;
+
+       cp = mtod(om, u_char *);
+       cnt = om->m_len;
+       for (; cnt > 0; cnt -= optlen, cp += optlen) {
+               opt = cp[0];
+               if (opt == TCPOPT_EOL)
+                       break;
+               if (opt == TCPOPT_NOP)
+                       optlen = 1;
+               else
+                       optlen = cp[1];
+               switch (opt) {
+
+               default:
+                       break;
+
+               case TCPOPT_MAXSEG:
+                       if (optlen != 4)
+                               continue;
+                       tp->t_maxseg = *(u_short *)(cp + 2);
+#if vax
+                       tp->t_maxseg = ntohs(tp->t_maxseg);
+#endif
+                       break;
+                       
+#ifdef TCPTRUEOOB
+               case TCPOPT_WILLOOB:
+                       tp->t_flags |= TF_DOOOB;
+printf("tp %x dooob\n", tp);
+                       break;
+
+               case TCPOPT_OOBDATA: {
+                       int seq;
+                       register struct socket *so = tp->t_inpcb->inp_socket;
+                       tcp_seq mark;
+
+                       if (optlen != 8)
+                               continue;
+                       seq = cp[2];
+                       if (seq < tp->t_iobseq)
+                               seq += 256;
+printf("oobdata cp[2] %d iobseq %d seq %d\n", cp[2], tp->t_iobseq, seq);
+                       if (seq - tp->t_iobseq > 128) {
+printf("bad seq\n");
+                               tp->t_oobflags |= TCPOOB_OWEACK;
+                               break;
+                       }
+                       tp->t_iobseq = cp[2];
+                       tp->t_iobc = cp[3];
+                       mark = *(tcp_seq *)(cp + 4);
+#if vax
+                       mark = ntohl(mark);
+#endif
+                       so->so_oobmark = so->so_rcv.sb_cc + (mark-tp->rcv_nxt);
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+printf("take oob data %x input iobseq now %x\n", tp->t_iobc, tp->t_iobseq);
+                       sohasoutofband(so);
+                       break;
+               }
+
+               case TCPOPT_OOBACK: {
+                       int seq;
+
+                       if (optlen != 4)
+                               continue;
+                       if (tp->t_oobseq != cp[2]) {
+printf("wrong ack\n");
+                               break;
+                       }
+printf("take oob ack %x and cancel rexmt\n", cp[2]);
+                       tp->t_oobflags &= ~TCPOOB_NEEDACK;
+                       tp->t_timer[TCPT_OOBREXMT] = 0;
+                       break;
+               }
+#endif TCPTRUEOOB
+               }
+       }
+       m_free(om);
+}
+
+/*
+ * Pull out of band byte out of a segment so
+ * it doesn't appear in the user's data queue.
+ * It is still reflected in the segment length for
+ * sequencing purposes.
+ */
+tcp_pulloutofband(so, ti)
+       struct socket *so;
+       struct tcpiphdr *ti;
+{
+       register struct mbuf *m;
+       int cnt = sizeof (struct tcpiphdr) + ti->ti_urp - 1;
+       
+       m = dtom(ti);
+       while (cnt >= 0) {
+               if (m->m_len > cnt) {
+                       char *cp = mtod(m, caddr_t) + cnt;
+                       struct tcpcb *tp = sototcpcb(so);
+
+                       tp->t_iobc = *cp;
+                       tp->t_oobflags |= TCPOOB_HAVEDATA;
+                       bcopy(cp+1, cp, m->m_len - cnt - 1);
+                       m->m_len--;
+                       return;
+               }
+               cnt -= m->m_len;
+               m = m->m_next;
+               if (m == 0)
+                       break;
+       }
+       panic("tcp_pulloutofband");
+}
+
 /*
  * Insert segment ti into reassembly queue of tcp with
  * control block tp.  Return TH_FIN if reassembly now includes
 /*
  * Insert segment ti into reassembly queue of tcp with
  * control block tp.  Return TH_FIN if reassembly now includes
@@ -665,7 +837,7 @@ COUNT(TCP_REASS);
         */
        if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
                register int i;
         */
        if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
                register int i;
-               q = (struct tcpiphdr *)(q->ti_prev);
+               q = (struct tcpiphdr *)q->ti_prev;
                /* conversion to int (in i) handles seq wraparound */
                i = q->ti_seq + q->ti_len - ti->ti_seq;
                if (i > 0) {
                /* conversion to int (in i) handles seq wraparound */
                i = q->ti_seq + q->ti_len - ti->ti_seq;
                if (i > 0) {
@@ -682,17 +854,20 @@ COUNT(TCP_REASS);
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
-       while (q != (struct tcpiphdr *)tp &&
-           SEQ_GT(ti->ti_seq + ti->ti_len, q->ti_seq)) {
+       while (q != (struct tcpiphdr *)tp) {
                register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
                register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
+               if (i <= 0)
+                       break;
                if (i < q->ti_len) {
                if (i < q->ti_len) {
+                       q->ti_seq += i;
                        q->ti_len -= i;
                        m_adj(dtom(q), i);
                        break;
                }
                q = (struct tcpiphdr *)q->ti_next;
                        q->ti_len -= i;
                        m_adj(dtom(q), i);
                        break;
                }
                q = (struct tcpiphdr *)q->ti_next;
-               m_freem(dtom(q->ti_prev));
+               m = dtom(q->ti_prev);
                remque(q->ti_prev);
                remque(q->ti_prev);
+               m_freem(m);
        }
 
        /*
        }
 
        /*