[src/netbsd-8]: src/sys Pull up following revision(s) (requested by ozaki-r i...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2d14b87a258a
branches:  netbsd-8
changeset: 319725:2d14b87a258a
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Jun 08 10:14:33 2018 +0000

description:
Pull up following revision(s) (requested by ozaki-r in ticket #852):

        sys/netinet6/icmp6.c: revision 1.238
        sys/netinet/ip_icmp.c: revision 1.171
        sys/net/route.c: revision 1.210

Fix _rt_free via rtrequest(RTM_DELETE) hangs in rt_timer handlers

A rt_timer handler is passed a rtentry with an extra reference that avoids the
rtentry is accidentally released.  So rt_timer handers must release
the reference of a passed rtentry by themselves (but they didn't).

diffstat:

 sys/net/route.c       |  11 ++++++++---
 sys/netinet/ip_icmp.c |  14 ++++++++++----
 sys/netinet6/icmp6.c  |  15 +++++++++++----
 3 files changed, 29 insertions(+), 11 deletions(-)

diffs (145 lines):

diff -r 22820f8c9e8e -r 2d14b87a258a sys/net/route.c
--- a/sys/net/route.c   Fri Jun 08 10:08:06 2018 +0000
+++ b/sys/net/route.c   Fri Jun 08 10:14:33 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: route.c,v 1.194.6.9 2018/04/14 10:16:19 martin Exp $   */
+/*     $NetBSD: route.c,v 1.194.6.10 2018/06/08 10:14:33 martin Exp $  */
 
 /*-
  * Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.194.6.9 2018/04/14 10:16:19 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.194.6.10 2018/06/08 10:14:33 martin Exp $");
 
 #include <sys/param.h>
 #ifdef RTFLUSH_DEBUG
@@ -1959,7 +1959,12 @@
                    (r->rtt_time + rtq->rtq_timeout) < time_uptime) {
                        LIST_REMOVE(r, rtt_link);
                        TAILQ_REMOVE(&rtq->rtq_head, r, rtt_next);
-                       rt_ref(r->rtt_rt); /* XXX */
+                       /*
+                        * Take a reference to avoid the rtentry is freed
+                        * accidentally after RT_UNLOCK.  The callback
+                        * (rtt_func) must rt_unref it by itself.
+                        */
+                       rt_ref(r->rtt_rt);
                        RT_REFCNT_TRACE(r->rtt_rt);
                        RT_UNLOCK();
                        (*r->rtt_func)(r->rtt_rt, r);
diff -r 22820f8c9e8e -r 2d14b87a258a sys/netinet/ip_icmp.c
--- a/sys/netinet/ip_icmp.c     Fri Jun 08 10:08:06 2018 +0000
+++ b/sys/netinet/ip_icmp.c     Fri Jun 08 10:14:33 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_icmp.c,v 1.161.6.1 2018/03/31 10:38:53 martin Exp $ */
+/*     $NetBSD: ip_icmp.c,v 1.161.6.2 2018/06/08 10:14:33 martin Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -94,7 +94,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.161.6.1 2018/03/31 10:38:53 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.161.6.2 2018/06/08 10:14:33 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -1310,6 +1310,7 @@
 static void
 icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r)
 {
+       struct rtentry *retrt;
 
        KASSERT(rt != NULL);
        rt_assert_referenced(rt);
@@ -1317,7 +1318,9 @@
        if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
            (RTF_DYNAMIC | RTF_HOST)) {
                rtrequest(RTM_DELETE, rt_getkey(rt),
-                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, &retrt);
+               rt_unref(rt);
+               rt_free(retrt);
        } else {
                if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
                        rt->rt_rmx.rmx_mtu = 0;
@@ -1328,6 +1331,7 @@
 static void
 icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r)
 {
+       struct rtentry *retrt;
 
        KASSERT(rt != NULL);
        rt_assert_referenced(rt);
@@ -1335,7 +1339,9 @@
        if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
            (RTF_DYNAMIC | RTF_HOST)) {
                rtrequest(RTM_DELETE, rt_getkey(rt),
-                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, &retrt);
+               rt_unref(rt);
+               rt_free(retrt);
        }
 }
 
diff -r 22820f8c9e8e -r 2d14b87a258a sys/netinet6/icmp6.c
--- a/sys/netinet6/icmp6.c      Fri Jun 08 10:08:06 2018 +0000
+++ b/sys/netinet6/icmp6.c      Fri Jun 08 10:14:33 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: icmp6.c,v 1.211.6.5 2018/04/09 13:34:10 bouyer Exp $   */
+/*     $NetBSD: icmp6.c,v 1.211.6.6 2018/06/08 10:14:33 martin Exp $   */
 /*     $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.211.6.5 2018/04/09 13:34:10 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.211.6.6 2018/06/08 10:14:33 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -2872,6 +2872,7 @@
 static void
 icmp6_mtudisc_timeout(struct rtentry *rt, struct rttimer *r)
 {
+       struct rtentry *retrt;
 
        KASSERT(rt != NULL);
        rt_assert_referenced(rt);
@@ -2879,7 +2880,9 @@
        if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
            (RTF_DYNAMIC | RTF_HOST)) {
                rtrequest(RTM_DELETE, rt_getkey(rt),
-                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, &retrt);
+               rt_unref(rt);
+               rt_free(retrt);
        } else {
                if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
                        rt->rt_rmx.rmx_mtu = 0;
@@ -2889,14 +2892,18 @@
 static void
 icmp6_redirect_timeout(struct rtentry *rt, struct rttimer *r)
 {
+       struct rtentry *retrt;
 
        KASSERT(rt != NULL);
        rt_assert_referenced(rt);
 
        if ((rt->rt_flags & (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) ==
            (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) {
+               printf("%s: RTM_DELETE\n", __func__);
                rtrequest(RTM_DELETE, rt_getkey(rt),
-                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+                   rt->rt_gateway, rt_mask(rt), rt->rt_flags, &retrt);
+               rt_unref(rt);
+               rt_free(retrt);
        }
 }