In loop_clone_destroy() the routing table is reset too early. The issue is
that if_detach does all the route cleanup and so the rdomain should not be
changed until if_detach() finished.

My previoous diff (fixing the rtlabel confusion) adds a KASSERT() in
rt_ifa_del() which triggers because of this.

-- 
:wq Claudio

Index: if_loop.c
===================================================================
RCS file: /cvs/src/sys/net/if_loop.c,v
retrieving revision 1.89
diff -u -p -r1.89 if_loop.c
--- if_loop.c   6 Aug 2019 22:57:54 -0000       1.89
+++ if_loop.c   14 Aug 2019 17:57:07 -0000
@@ -196,6 +196,7 @@ int
 loop_clone_destroy(struct ifnet *ifp)
 {
        struct ifnet    *p;
+       unsigned int     rdomain = 0;
 
        if (ifp->if_index == rtable_loindex(ifp->if_rdomain)) {
                /* rdomain 0 always needs a loopback */
@@ -214,13 +215,16 @@ loop_clone_destroy(struct ifnet *ifp)
                }
                NET_UNLOCK();
 
-               rtable_l2set(ifp->if_rdomain, 0, 0);
+               rdomain = ifp->if_rdomain;
        }
 
        if_ih_remove(ifp, loinput, NULL);
        if_detach(ifp);
 
        free(ifp, M_DEVBUF, sizeof(*ifp));
+
+       if (rdomain)
+               rtable_l2set(rdomain, 0, 0);
        return (0);
 }
 

Reply via email to