From owner-svn-src-all@FreeBSD.ORG Sat Jan 31 10:48:02 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B6D411065700; Sat, 31 Jan 2009 10:48:02 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id A46928FC18; Sat, 31 Jan 2009 10:48:02 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n0VAm2eZ018900; Sat, 31 Jan 2009 10:48:02 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n0VAm2Je018895; Sat, 31 Jan 2009 10:48:02 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <200901311048.n0VAm2Je018895@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Sat, 31 Jan 2009 10:48:02 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r187946 - in head/sys: net netinet6 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Jan 2009 10:48:03 -0000 Author: bz Date: Sat Jan 31 10:48:02 2009 New Revision: 187946 URL: http://svn.freebsd.org/changeset/base/187946 Log: Like with r185713 make sure to not leak a lock as rtalloc1(9) returns a locked route. Thus we have to use RTFREE_LOCKED(9) to get it unlocked and rtfree(9)d rather than just rtfree(9)d. Since the PR was filed, new places with the same problem were added with new code. Also check that the rt is valid before freeing it either way there. PR: kern/129793 Submitted by: Dheeraj Reddy MFC after: 2 weeks Committed from: Bugathon #6 Modified: head/sys/net/if_llatbl.c head/sys/netinet6/in6.c head/sys/netinet6/in6_gif.c head/sys/netinet6/in6_ifattach.c head/sys/netinet6/nd6_nbr.c Modified: head/sys/net/if_llatbl.c ============================================================================== --- head/sys/net/if_llatbl.c Sat Jan 31 10:04:36 2009 (r187945) +++ head/sys/net/if_llatbl.c Sat Jan 31 10:48:02 2009 (r187946) @@ -219,10 +219,11 @@ lla_rt_output(struct rt_msghdr *rtm, str log(LOG_INFO, "%s: RTM_ADD publish " "(proxy only) is invalid\n", __func__); - RTFREE(rt); + if (rt) + RTFREE_LOCKED(rt); return EINVAL; } - RTFREE(rt); + RTFREE_LOCKED(rt); flags |= LLE_PROXY; } Modified: head/sys/netinet6/in6.c ============================================================================== --- head/sys/netinet6/in6.c Sat Jan 31 10:04:36 2009 (r187945) +++ head/sys/netinet6/in6.c Sat Jan 31 10:48:02 2009 (r187946) @@ -2122,16 +2122,16 @@ in6_lltable_rtcheck(struct ifnet *ifp, c ifa = ifaof_ifpforaddr(__DECONST(struct sockaddr *, l3addr), ifp); if (ifa != NULL) { if (rt != NULL) - rtfree(rt); + RTFREE_LOCKED(rt); return 0; } log(LOG_INFO, "IPv6 address: \"%s\" is not on the network\n", ip6_sprintf(ip6buf, &((const struct sockaddr_in6 *)l3addr)->sin6_addr)); if (rt != NULL) - rtfree(rt); + RTFREE_LOCKED(rt); return EINVAL; } - rtfree(rt); + RTFREE_LOCKED(rt); return 0; } Modified: head/sys/netinet6/in6_gif.c ============================================================================== --- head/sys/netinet6/in6_gif.c Sat Jan 31 10:04:36 2009 (r187945) +++ head/sys/netinet6/in6_gif.c Sat Jan 31 10:48:02 2009 (r187946) @@ -378,10 +378,10 @@ gif_validate6(const struct ip6_hdr *ip6, ip6_sprintf(ip6buf, &sin6.sin6_addr)); #endif if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); return 0; } - rtfree(rt); + RTFREE_LOCKED(rt); } return 128 * 2; Modified: head/sys/netinet6/in6_ifattach.c ============================================================================== --- head/sys/netinet6/in6_ifattach.c Sat Jan 31 10:04:36 2009 (r187945) +++ head/sys/netinet6/in6_ifattach.c Sat Jan 31 10:48:02 2009 (r187946) @@ -778,7 +778,7 @@ in6_ifdetach(struct ifnet *ifp) if ((ia->ia_flags & IFA_ROUTE) && (rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0, 0UL))) { rtflags = rt->rt_flags; - rtfree(rt); + RTFREE_LOCKED(rt); rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr, (struct sockaddr *)&ia->ia_addr, (struct sockaddr *)&ia->ia_prefixmask, Modified: head/sys/netinet6/nd6_nbr.c ============================================================================== --- head/sys/netinet6/nd6_nbr.c Sat Jan 31 10:04:36 2009 (r187945) +++ head/sys/netinet6/nd6_nbr.c Sat Jan 31 10:48:02 2009 (r187946) @@ -259,7 +259,7 @@ nd6_ns_input(struct mbuf *m, int off, in need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && rt->rt_gateway->sa_family == AF_LINK); if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); if (need_proxy) { /* * proxy NDP for single entry