From 2e730bea0af04061e1bcfd7f4d49b5ea0024be85 Mon Sep 17 00:00:00 2001
From: "Bjoern A. Zeeb" <bz@FreeBSD.org>
Date: Sat, 31 Jan 2009 10:48:02 +0000
Subject: [PATCH] Like with r185713 make sure to not leak a lock as rtalloc1(9)
 returns a locked route. Thus we have to use RTFREE_LOCKED(9) to get it
 unlocked and rtfree(9)d rather than just rtfree(9)d.

Since the PR was filed, new places with the same problem were added
with new code.  Also check that the rt is valid before freeing it
either way there.

PR:		kern/129793
Submitted by:	Dheeraj Reddy <dheeraj@ece.gatech.edu>
MFC after:	2 weeks
Committed from:	Bugathon #6
---
 sys/net/if_llatbl.c         | 5 +++--
 sys/netinet6/in6.c          | 6 +++---
 sys/netinet6/in6_gif.c      | 4 ++--
 sys/netinet6/in6_ifattach.c | 2 +-
 sys/netinet6/nd6_nbr.c      | 2 +-
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/sys/net/if_llatbl.c b/sys/net/if_llatbl.c
index a3d1b05c4bac..2287f92c7e95 100644
--- a/sys/net/if_llatbl.c
+++ b/sys/net/if_llatbl.c
@@ -219,10 +219,11 @@ lla_rt_output(struct rt_msghdr *rtm, struct rt_addrinfo *info)
 					log(LOG_INFO, "%s: RTM_ADD publish "
 					    "(proxy only) is invalid\n",
 					    __func__);
-					RTFREE(rt);
+					if (rt)
+						RTFREE_LOCKED(rt);
 					return EINVAL;
 				}
-				RTFREE(rt);
+				RTFREE_LOCKED(rt);
 
 				flags |= LLE_PROXY;
 			}
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index fc0333b82132..693a2f979d38 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -2122,16 +2122,16 @@ in6_lltable_rtcheck(struct ifnet *ifp, const struct sockaddr *l3addr)
 		ifa = ifaof_ifpforaddr(__DECONST(struct sockaddr *, l3addr), ifp);
 		if (ifa != NULL) {
 			if (rt != NULL)
-				rtfree(rt);
+				RTFREE_LOCKED(rt);
 			return 0;
 		}
 		log(LOG_INFO, "IPv6 address: \"%s\" is not on the network\n",
 		    ip6_sprintf(ip6buf, &((const struct sockaddr_in6 *)l3addr)->sin6_addr));
 		if (rt != NULL)
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 		return EINVAL;
 	}
-	rtfree(rt);
+	RTFREE_LOCKED(rt);
 	return 0;
 }
 
diff --git a/sys/netinet6/in6_gif.c b/sys/netinet6/in6_gif.c
index 3e17819598f6..bba348f83cb6 100644
--- a/sys/netinet6/in6_gif.c
+++ b/sys/netinet6/in6_gif.c
@@ -378,10 +378,10 @@ gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
 			    ip6_sprintf(ip6buf, &sin6.sin6_addr));
 #endif
 			if (rt)
-				rtfree(rt);
+				RTFREE_LOCKED(rt);
 			return 0;
 		}
-		rtfree(rt);
+		RTFREE_LOCKED(rt);
 	}
 
 	return 128 * 2;
diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c
index 292501d905ce..ca5428dc9adb 100644
--- a/sys/netinet6/in6_ifattach.c
+++ b/sys/netinet6/in6_ifattach.c
@@ -778,7 +778,7 @@ in6_ifdetach(struct ifnet *ifp)
 		if ((ia->ia_flags & IFA_ROUTE) &&
 		    (rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0, 0UL))) {
 			rtflags = rt->rt_flags;
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 			rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_prefixmask,
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index 84e415a83752..1f88fb1e92fd 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -259,7 +259,7 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 		need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
 		    rt->rt_gateway->sa_family == AF_LINK);
 		if (rt)
-			rtfree(rt);
+			RTFREE_LOCKED(rt);
 		if (need_proxy) {
 			/*
 			 * proxy NDP for single entry