#ifdef INET_REFCNT_DEBUG atomic_inc(&inet_sock_nr); #endif 
 /* * Increment the counter in the same struct proto as the master * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that * is the same as sk->sk_prot->socks, as this field was copied * with memcpy), same rationale as the first comment in this * function. * * This _changes_ the previous behaviour, where * tcp_create_openreq_child always was incrementing the * equivalent to tcp_prot->socks (inet_sock_nr), so this have * to be taken into account in all callers. -acme */ sk_refcnt_debug_inc(newsk);  
struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb){	/* allocate the newsk from the same slab of the master sock,	 * if not, at sk_free time we'll try to free it from the wrong	 * slabcache (i.e. is it TCPv4 or v6?), this is handled thru sk->sk_prot -acme */	struct sock *newsk = sk_alloc(PF_INET, GFP_ATOMIC, sk->sk_prot, 0);	if(newsk != NULL) {		struct inet_request_sock *ireq = inet_rsk(req);		struct tcp_request_sock *treq = tcp_rsk(req);		struct tcp_sock *newtp;		struct sk_filter *filter;		memcpy(newsk, sk, sizeof(struct tcp_sock));		newsk->sk_state = TCP_SYN_RECV;		/* SANITY */		sk_node_init(&newsk->sk_node);		tcp_sk(newsk)->bind_hash = NULL;		/* Clone the TCP header template */		inet_sk(newsk)->dport = ireq->rmt_port;		sock_lock_init(newsk);		bh_lock_sock(newsk);		rwlock_init(&newsk->sk_dst_lock);		atomic_set(&newsk->sk_rmem_alloc, 0);		skb_queue_head_init(&newsk->sk_receive_queue);		atomic_set(&newsk->sk_wmem_alloc, 0);		skb_queue_head_init(&newsk->sk_write_queue);		atomic_set(&newsk->sk_omem_alloc, 0);		newsk->sk_wmem_queued = 0;		newsk->sk_forward_alloc = 0;		sock_reset_flag(newsk, SOCK_DONE);		newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;		newsk->sk_backlog.head = newsk->sk_backlog.tail = NULL;		newsk->sk_send_head = NULL;		rwlock_init(&newsk->sk_callback_lock);		skb_queue_head_init(&newsk->sk_error_queue);		newsk->sk_write_space = sk_stream_write_space;		if ((filter = newsk->sk_filter) != NULL)			sk_filter_charge(newsk, filter);		if (unlikely(xfrm_sk_clone_policy(newsk))) {			/* It is still raw copy of parent, so invalidate			 * destructor and make plain sk_free() */			newsk->sk_destruct = NULL;			sk_free(newsk);			return NULL;		}		/* Now setup tcp_sock */		newtp = tcp_sk(newsk);		newtp->pred_flags = 0;		newtp->rcv_nxt = treq->rcv_isn + 1;		newtp->snd_nxt = treq->snt_isn + 1;		newtp->snd_una = treq->snt_isn + 1;		newtp->snd_sml = treq->snt_isn + 1;		tcp_prequeue_init(newtp);		tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);		newtp->retransmits = 0;		newtp->backoff = 0;		newtp->srtt = 0;		newtp->mdev = TCP_TIMEOUT_INIT;		newtp->rto = TCP_TIMEOUT_INIT;		newtp->packets_out = 0;		newtp->left_out = 0;		newtp->retrans_out = 0;		newtp->sacked_out = 0;		newtp->fackets_out = 0;		newtp->snd_ssthresh = 0x7fffffff;		/* So many TCP implementations out there (incorrectly) count the		 * initial SYN frame in their delayed-ACK and congestion control		 * algorithms that we must have the following bandaid to talk		 * efficiently to them.  -DaveM		 */		newtp->snd_cwnd = 2;		newtp->snd_cwnd_cnt = 0;		newtp->frto_counter = 0;		newtp->frto_highmark = 0;		newtp->ca_ops = &tcp_reno;		tcp_set_ca_state(newtp, TCP_CA_Open);		tcp_init_xmit_timers(newsk);		skb_queue_head_init(&newtp->out_of_order_queue);		newtp->rcv_wup = treq->rcv_isn + 1;		newtp->write_seq = treq->snt_isn + 1;		newtp->pushed_seq = newtp->write_seq;		newtp->copied_seq = treq->rcv_isn + 1;		newtp->rx_opt.saw_tstamp = 0;		newtp->rx_opt.dsack = 0;		newtp->rx_opt.eff_sacks = 0;		newtp->probes_out = 0;		newtp->rx_opt.num_sacks = 0;		newtp->urg_data = 0;		/* Deinitialize accept_queue to trap illegal accesses. */		memset(&newtp->accept_queue, 0, sizeof(newtp->accept_queue));		/* Back to base struct sock members. */		newsk->sk_err = 0;		newsk->sk_priority = 0;		atomic_set(&newsk->sk_refcnt, 2);#ifdef INET_REFCNT_DEBUG		atomic_inc(&inet_sock_nr);#endif		atomic_inc(&tcp_sockets_allocated);		if (sock_flag(newsk, SOCK_KEEPOPEN))			tcp_reset_keepalive_timer(newsk,						  keepalive_time_when(newtp));		newsk->sk_socket = NULL;		newsk->sk_sleep = NULL;		newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;		if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {			if (sysctl_tcp_fack)				newtp->rx_opt.sack_ok |= 2;		}		newtp->window_clamp = req->window_clamp;		newtp->rcv_ssthresh = req->rcv_wnd;		newtp->rcv_wnd = req->rcv_wnd;		newtp->rx_opt.wscale_ok = ireq->wscale_ok;		if (newtp->rx_opt.wscale_ok) {			newtp->rx_opt.snd_wscale = ireq->snd_wscale;			newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;		} else {			newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;			newtp->window_clamp = min(newtp->window_clamp, 65535U);		}		newtp->snd_wnd = ntohs(skb->h.th->window) << newtp->rx_opt.snd_wscale;		newtp->max_window = newtp->snd_wnd;		if (newtp->rx_opt.tstamp_ok) {			newtp->rx_opt.ts_recent = req->ts_recent;			newtp->rx_opt.ts_recent_stamp = xtime.tv_sec;			newtp->tcp_header_len = sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;		} else {			newtp->rx_opt.ts_recent_stamp = 0;			newtp->tcp_header_len = sizeof(struct tcphdr);		}		if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)			newtp->ack.last_seg_size = skb->len-newtp->tcp_header_len;		newtp->rx_opt.mss_clamp = req->mss;		TCP_ECN_openreq_child(newtp, req);		if (newtp->ecn_flags&TCP_ECN_OK)			sock_set_flag(newsk, SOCK_NO_LARGESEND);		TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);	}	return newsk;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/e6848976b721eeb5551cd94673faafeef78d9f35/tcp_minisocks.c/buggy/net/ipv4/tcp_minisocks.c