From owner-svn-src-all@FreeBSD.ORG Tue Aug 25 21:51:48 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 457FA106568C; Tue, 25 Aug 2009 21:51:48 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 3298C8FC19; Tue, 25 Aug 2009 21:51:48 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n7PLpl8g040746; Tue, 25 Aug 2009 21:51:47 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n7PLpl3n040737; Tue, 25 Aug 2009 21:51:47 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <200908252151.n7PLpl3n040737@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Tue, 25 Aug 2009 21:51:47 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org X-SVN-Group: stable-6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r196557 - in stable/6/sys: . contrib/pf dev/cxgb net netinet netinet6 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Aug 2009 21:51:48 -0000 Author: bz Date: Tue Aug 25 21:51:47 2009 New Revision: 196557 URL: http://svn.freebsd.org/changeset/base/196557 Log: MFC r185713 (from csjp): in_rtalloc1(9) returns a locked route, so make sure that we use RTFREE_LOCKED() here. This macro makes sure the reference count on the route is being managed properly. MFC r187946: Like with r185713 make sure to not leak a lock as rtalloc1(9) returns a locked route. Thus we have to use RTFREE_LOCKED(9) to get it either rtfree(9)d or the reference count decremented and unlocked depending on the reference count. [Note: the original commit message was bogus here]. RELENG_6 had a few more places that either had changed or were already fixed in HEAD/7 at the time above revisions were done so just fixed them along with the MFCs. Modified: stable/6/sys/ (props changed) stable/6/sys/contrib/pf/ (props changed) stable/6/sys/dev/cxgb/ (props changed) stable/6/sys/net/if_stf.c stable/6/sys/netinet/if_ether.c stable/6/sys/netinet/in_gif.c stable/6/sys/netinet6/in6.c stable/6/sys/netinet6/in6_gif.c stable/6/sys/netinet6/in6_ifattach.c stable/6/sys/netinet6/nd6.c stable/6/sys/netinet6/nd6_nbr.c Modified: stable/6/sys/net/if_stf.c ============================================================================== --- stable/6/sys/net/if_stf.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/net/if_stf.c Tue Aug 25 21:51:47 2009 (r196557) @@ -646,10 +646,10 @@ stf_checkaddr4(sc, in, inifp) (u_int32_t)ntohl(sin.sin_addr.s_addr)); #endif if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); return -1; } - rtfree(rt); + RTFREE_LOCKED(rt); } return 0; Modified: stable/6/sys/netinet/if_ether.c ============================================================================== --- stable/6/sys/netinet/if_ether.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet/if_ether.c Tue Aug 25 21:51:47 2009 (r196557) @@ -854,12 +854,12 @@ reply: * over who claims what Ether address. */ if (rt->rt_ifp == ifp) { - rtfree(rt); + RTFREE_LOCKED(rt); goto drop; } (void)memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln); (void)memcpy(ar_sha(ah), enaddr, ah->ar_hln); - rtfree(rt); + RTFREE_LOCKED(rt); /* * Also check that the node which sent the ARP packet @@ -877,10 +877,10 @@ reply: " from %s via %s, expecting %s\n", inet_ntoa(isaddr), ifp->if_xname, rt->rt_ifp->if_xname); - rtfree(rt); + RTFREE_LOCKED(rt); goto drop; } - rtfree(rt); + RTFREE_LOCKED(rt); #ifdef DEBUG_PROXY printf("arp: proxying for %s\n", Modified: stable/6/sys/netinet/in_gif.c ============================================================================== --- stable/6/sys/netinet/in_gif.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet/in_gif.c Tue Aug 25 21:51:47 2009 (r196557) @@ -398,10 +398,10 @@ gif_validate4(ip, sc, ifp) (u_int32_t)ntohl(sin.sin_addr.s_addr)); #endif if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); return 0; } - rtfree(rt); + RTFREE_LOCKED(rt); } return 32 * 2; Modified: stable/6/sys/netinet6/in6.c ============================================================================== --- stable/6/sys/netinet6/in6.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet6/in6.c Tue Aug 25 21:51:47 2009 (r196557) @@ -190,7 +190,7 @@ in6_ifloop_request(int cmd, struct ifadd rt_newaddrmsg(cmd, ifa, e, nrt); if (cmd == RTM_DELETE) { - rtfree(nrt); + RTFREE_LOCKED(nrt); } else { /* the cmd must be RTM_ADD here */ RT_REMREF(nrt); @@ -217,7 +217,7 @@ in6_ifaddloop(struct ifaddr *ifa) need_loop = (rt == NULL || (rt->rt_flags & RTF_HOST) == 0 || (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0); if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); if (need_loop) in6_ifloop_request(RTM_ADD, ifa); } @@ -269,7 +269,7 @@ in6_ifremloop(struct ifaddr *ifa) if (rt != NULL) { if ((rt->rt_flags & RTF_HOST) != 0 && (rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) { - rtfree(rt); + RTFREE_LOCKED(rt); in6_ifloop_request(RTM_DELETE, ifa); } else RT_UNLOCK(rt); Modified: stable/6/sys/netinet6/in6_gif.c ============================================================================== --- stable/6/sys/netinet6/in6_gif.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet6/in6_gif.c Tue Aug 25 21:51:47 2009 (r196557) @@ -392,10 +392,10 @@ gif_validate6(ip6, sc, ifp) ip6_sprintf(&sin6.sin6_addr)); #endif if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); return 0; } - rtfree(rt); + RTFREE_LOCKED(rt); } return 128 * 2; Modified: stable/6/sys/netinet6/in6_ifattach.c ============================================================================== --- stable/6/sys/netinet6/in6_ifattach.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet6/in6_ifattach.c Tue Aug 25 21:51:47 2009 (r196557) @@ -772,7 +772,7 @@ in6_ifdetach(ifp) if ((ia->ia_flags & IFA_ROUTE) && (rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0, 0UL))) { rtflags = rt->rt_flags; - rtfree(rt); + RTFREE_LOCKED(rt); rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr, (struct sockaddr *)&ia->ia_addr, (struct sockaddr *)&ia->ia_prefixmask, Modified: stable/6/sys/netinet6/nd6.c ============================================================================== --- stable/6/sys/netinet6/nd6.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet6/nd6.c Tue Aug 25 21:51:47 2009 (r196557) @@ -2009,7 +2009,7 @@ again: rt = rt->rt_gwroute; RT_LOCK(rt); /* NB: gwroute */ if ((rt->rt_flags & RTF_UP) == 0) { - rtfree(rt); /* unlock gwroute */ + RTFREE_LOCKED(rt); /* unlock gwroute */ rt = rt0; rt0->rt_gwroute = NULL; lookup: Modified: stable/6/sys/netinet6/nd6_nbr.c ============================================================================== --- stable/6/sys/netinet6/nd6_nbr.c Tue Aug 25 21:44:14 2009 (r196556) +++ stable/6/sys/netinet6/nd6_nbr.c Tue Aug 25 21:51:47 2009 (r196557) @@ -239,7 +239,7 @@ nd6_ns_input(m, off, icmp6len) need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && rt->rt_gateway->sa_family == AF_LINK); if (rt) - rtfree(rt); + RTFREE_LOCKED(rt); if (need_proxy) { /* * proxy NDP for single entry