svn commit: r213687 - in stable: 7/sys/netinet 7/sys/netinet6 8/sys/netinet 8/sys/netinet6

[Xin LI]

Author: delphij
Date: Mon Oct 11 11:25:37 2010
New Revision: 213687
URL: http://svn.freebsd.org/changeset/base/213687

Log:
  MFC r213225:
  
  Add a bandaid for a long-standing race condition during route entry
  un-expiring.
  
  The previous version of code have no locking when testing rt_refcnt.
  The result of the lack of locking may result in a condition where
  a routing entry have a reference count but at the same time have
  RTPRF_OURS bit set and an expiration timer.  These would eventually
  lead to a panic:
  
  	panic: rtqkill route really not free
  
  When the system have ICMP redirects accepted from local gateway
  in a moderate frequency, for instance.
  
  Commit this workaround for now until we have some better solution.
  
  PR:		kern/149804
  Reviewed by:	bz
  Tested by:	Zhao Xin, Pete French

Modified:
  stable/8/sys/netinet/in_rmx.c
  stable/8/sys/netinet6/in6_rmx.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/7/sys/netinet/in_rmx.c
  stable/7/sys/netinet6/in6_rmx.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/netinet/in_rmx.c
==============================================================================
--- stable/8/sys/netinet/in_rmx.c	Mon Oct 11 09:42:30 2010	(r213686)
+++ stable/8/sys/netinet/in_rmx.c	Mon Oct 11 11:25:37 2010	(r213687)
@@ -121,12 +121,13 @@ in_matroute(void *v_arg, struct radix_no
 	struct radix_node *rn = rn_match(v_arg, head);
 	struct rtentry *rt = (struct rtentry *)rn;
 
-	/*XXX locking? */
-	if (rt && rt->rt_refcnt == 0) {		/* this is first reference */
+	if (rt) {
+		RT_LOCK(rt);
 		if (rt->rt_flags & RTPRF_OURS) {
 			rt->rt_flags &= ~RTPRF_OURS;
 			rt->rt_rmx.rmx_expire = 0;
 		}
+		RT_UNLOCK(rt);
 	}
 	return rn;
 }

Modified: stable/8/sys/netinet6/in6_rmx.c
==============================================================================
--- stable/8/sys/netinet6/in6_rmx.c	Mon Oct 11 09:42:30 2010	(r213686)
+++ stable/8/sys/netinet6/in6_rmx.c	Mon Oct 11 11:25:37 2010	(r213687)
@@ -193,11 +193,13 @@ in6_matroute(void *v_arg, struct radix_n
 	struct radix_node *rn = rn_match(v_arg, head);
 	struct rtentry *rt = (struct rtentry *)rn;
 
-	if (rt && rt->rt_refcnt == 0) { /* this is first reference */
+	if (rt) {
+		RT_LOCK(rt);
 		if (rt->rt_flags & RTPRF_OURS) {
 			rt->rt_flags &= ~RTPRF_OURS;
 			rt->rt_rmx.rmx_expire = 0;
 		}
+		RT_UNLOCK(rt);
 	}
 	return rn;
 }