[src/trunk]: src/sys/net Delete rt_timers on RTM_DELETE surely

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/62b35617caf9
branches:  trunk
changeset: 348512:62b35617caf9
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Fri Oct 21 10:56:35 2016 +0000

description:
Delete rt_timers on RTM_DELETE surely

We want to ensure that a rtentry is referenced by nobody after
RTM_DELETE (except for the caller). However, rt_timer could
have a reference to the rtentry after that.

diffstat:

 sys/net/route.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (44 lines):

diff -r 0acdb96bf0e5 -r 62b35617caf9 sys/net/route.c
--- a/sys/net/route.c   Fri Oct 21 10:52:47 2016 +0000
+++ b/sys/net/route.c   Fri Oct 21 10:56:35 2016 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $      */
+/*     $NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $      */
 
 /*-
  * Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.178 2016/10/21 10:52:47 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.179 2016/10/21 10:56:35 ozaki-r Exp $");
 
 #include <sys/param.h>
 #ifdef RTFLUSH_DEBUG
@@ -473,7 +473,6 @@
        if (rt->rt_refcnt == 0 && (rt->rt_flags & RTF_UP) == 0) {
                rt_assert_inactive(rt);
                rttrash--;
-               rt_timer_remove_all(rt);
                ifa = rt->rt_ifa;
                rt->rt_ifa = NULL;
                ifafree(ifa);
@@ -853,6 +852,7 @@
                        ifa = NULL;
                }
                rttrash++;
+               rt_timer_remove_all(rt);
                if (ret_nrt) {
                        *ret_nrt = rt;
                        rt->rt_refcnt++;
@@ -1336,8 +1336,8 @@
                        r->rtt_queue->rtq_count--;
                else
                        printf("rt_timer_remove_all: rtq_count reached 0\n");
-               rtfree(r->rtt_rt);
                pool_put(&rttimer_pool, r);
+               rt->rt_refcnt--; /* XXX */
        }
 }