Module Name: src Committed By: ozaki-r Date: Fri Oct 21 10:56:35 UTC 2016
Modified Files: src/sys/net: route.c Log Message: Delete rt_timers on RTM_DELETE surely We want to ensure that a rtentry is referenced by nobody after RTM_DELETE (except for the caller). However, rt_timer could have a reference to the rtentry after that. To generate a diff of this commit: cvs rdiff -u -r1.178 -r1.179 src/sys/net/route.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/net/route.c diff -u src/sys/net/route.c:1.178 src/sys/net/route.c:1.179 --- src/sys/net/route.c:1.178 Fri Oct 21 10:52:47 2016 +++ src/sys/net/route.c Fri Oct 21 10:56:35 2016 @@ -1,4 +1,4 @@ -/* $NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $ */ +/* $NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $ */ /*- * Copyright (c) 1998, 2008 The NetBSD Foundation, Inc. @@ -97,7 +97,7 @@ #endif #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $"); +__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $"); #include <sys/param.h> #ifdef RTFLUSH_DEBUG @@ -473,7 +473,6 @@ rtfree(struct rtentry *rt) if (rt->rt_refcnt == 0 && (rt->rt_flags & RTF_UP) == 0) { rt_assert_inactive(rt); rttrash--; - rt_timer_remove_all(rt); ifa = rt->rt_ifa; rt->rt_ifa = NULL; ifafree(ifa); @@ -853,6 +852,7 @@ rtrequest1(int req, struct rt_addrinfo * ifa = NULL; } rttrash++; + rt_timer_remove_all(rt); if (ret_nrt) { *ret_nrt = rt; rt->rt_refcnt++; @@ -1336,8 +1336,8 @@ rt_timer_remove_all(struct rtentry *rt) r->rtt_queue->rtq_count--; else printf("rt_timer_remove_all: rtq_count reached 0\n"); - rtfree(r->rtt_rt); pool_put(&rttimer_pool, r); + rt->rt_refcnt--; /* XXX */ } }