svn commit: r187946 - in head/sys: net netinet6

[Bjoern A. Zeeb]

Author: bz
Date: Sat Jan 31 10:48:02 2009
New Revision: 187946
URL: http://svn.freebsd.org/changeset/base/187946

Log:
  Like with r185713 make sure to not leak a lock as rtalloc1(9) returns
  a locked route. Thus we have to use RTFREE_LOCKED(9) to get it unlocked
  and rtfree(9)d rather than just rtfree(9)d.
  
  Since the PR was filed, new places with the same problem were added
  with new code.  Also check that the rt is valid before freeing it
  either way there.
  
  PR:		kern/129793
  Submitted by:	Dheeraj Reddy <dheeraj at ece.gatech.edu>
  MFC after:	2 weeks
  Committed from:	Bugathon #6

Modified:
  head/sys/net/if_llatbl.c
  head/sys/netinet6/in6.c
  head/sys/netinet6/in6_gif.c
  head/sys/netinet6/in6_ifattach.c
  head/sys/netinet6/nd6_nbr.c

Modified: head/sys/net/if_llatbl.c
==============================================================================
--- head/sys/net/if_llatbl.c	Sat Jan 31 10:04:36 2009	(r187945)
+++ head/sys/net/if_llatbl.c	Sat Jan 31 10:48:02 2009	(r187946)
@@ -219,10 +219,11 @@ lla_rt_output(struct rt_msghdr *rtm, str
 					log(LOG_INFO, "%s: RTM_ADD publish "
 					    "(proxy only) is invalid\n",
 					    __func__);
-					RTFREE(rt);
+					if (rt)
+						RTFREE_LOCKED(rt);
 					return EINVAL;
 				}
-				RTFREE(rt);
+				RTFREE_LOCKED(rt);
 
 				flags |= LLE_PROXY;
 			}

Modified: head/sys/netinet6/in6.c
==============================================================================
--- head/sys/netinet6/in6.c	Sat Jan 31 10:04:36 2009	(r187945)
+++ head/sys/netinet6/in6.c	Sat Jan 31 10:48:02 2009	(r187946)
@@ -2122,16 +2122,16 @@ in6_lltable_rtcheck(struct ifnet *ifp, c
 		ifa = ifaof_ifpforaddr(__DECONST(struct sockaddr *, l3addr), ifp);
 		if (ifa != NULL) {
 			if (rt != NULL)
-				rtfree(rt);
+				RTFREE_LOCKED(rt);
 			return 0;
 		}
 		log(LOG_INFO, "IPv6 address: \"%s\" is not on the network\n",
 		    ip6_sprintf(ip6buf, &((const struct sockaddr_in6 *)l3addr)->sin6_addr));
 		if (rt != NULL)
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 		return EINVAL;
 	}
-	rtfree(rt);
+	RTFREE_LOCKED(rt);
 	return 0;
 }
 

Modified: head/sys/netinet6/in6_gif.c
==============================================================================
--- head/sys/netinet6/in6_gif.c	Sat Jan 31 10:04:36 2009	(r187945)
+++ head/sys/netinet6/in6_gif.c	Sat Jan 31 10:48:02 2009	(r187946)
@@ -378,10 +378,10 @@ gif_validate6(const struct ip6_hdr *ip6,
 			    ip6_sprintf(ip6buf, &sin6.sin6_addr));
 #endif
 			if (rt)
-				rtfree(rt);
+				RTFREE_LOCKED(rt);
 			return 0;
 		}
-		rtfree(rt);
+		RTFREE_LOCKED(rt);
 	}
 
 	return 128 * 2;

Modified: head/sys/netinet6/in6_ifattach.c
==============================================================================
--- head/sys/netinet6/in6_ifattach.c	Sat Jan 31 10:04:36 2009	(r187945)
+++ head/sys/netinet6/in6_ifattach.c	Sat Jan 31 10:48:02 2009	(r187946)
@@ -778,7 +778,7 @@ in6_ifdetach(struct ifnet *ifp)
 		if ((ia->ia_flags & IFA_ROUTE) &&
 		    (rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0, 0UL))) {
 			rtflags = rt->rt_flags;
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 			rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_prefixmask,

Modified: head/sys/netinet6/nd6_nbr.c
==============================================================================
--- head/sys/netinet6/nd6_nbr.c	Sat Jan 31 10:04:36 2009	(r187945)
+++ head/sys/netinet6/nd6_nbr.c	Sat Jan 31 10:48:02 2009	(r187946)
@@ -259,7 +259,7 @@ nd6_ns_input(struct mbuf *m, int off, in
 		need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
 		    rt->rt_gateway->sa_family == AF_LINK);
 		if (rt)
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 		if (need_proxy) {
 			/*
 			 * proxy NDP for single entry