Module Name: src
Committed By: ozaki-r
Date: Fri Oct 21 10:56:35 UTC 2016
Modified Files:
src/sys/net: route.c
Log Message:
Delete rt_timers on RTM_DELETE surely
We want to ensure that a rtentry is referenced by nobody after
RTM_DELETE (except for the caller). However, rt_timer could
have a reference to the rtentry after that.
To generate a diff of this commit:
cvs rdiff -u -r1.178 -r1.179 src/sys/net/route.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/route.c
diff -u src/sys/net/route.c:1.178 src/sys/net/route.c:1.179
--- src/sys/net/route.c:1.178 Fri Oct 21 10:52:47 2016
+++ src/sys/net/route.c Fri Oct 21 10:56:35 2016
@@ -1,4 +1,4 @@
-/* $NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $ */
+/* $NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $ */
/*-
* Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
#endif
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $");
#include <sys/param.h>
#ifdef RTFLUSH_DEBUG
@@ -473,7 +473,6 @@ rtfree(struct rtentry *rt)
if (rt->rt_refcnt == 0 && (rt->rt_flags & RTF_UP) == 0) {
rt_assert_inactive(rt);
rttrash--;
- rt_timer_remove_all(rt);
ifa = rt->rt_ifa;
rt->rt_ifa = NULL;
ifafree(ifa);
@@ -853,6 +852,7 @@ rtrequest1(int req, struct rt_addrinfo *
ifa = NULL;
}
rttrash++;
+ rt_timer_remove_all(rt);
if (ret_nrt) {
*ret_nrt = rt;
rt->rt_refcnt++;
@@ -1336,8 +1336,8 @@ rt_timer_remove_all(struct rtentry *rt)
r->rtt_queue->rtq_count--;
else
printf("rt_timer_remove_all: rtq_count reached 0\n");
- rtfree(r->rtt_rt);
pool_put(&rttimer_pool, r);
+ rt->rt_refcnt--; /* XXX */
}
}
