Re: possible bug when deleting a route during if_detach

[David Young <dyoung%pobox.com@localhost>]

On Thu, Feb 24, 2011 at 05:25:37PM +0000, gmcnutt wrote:
> if_detach() calls rt_walktree with if_rt_walktree as the visiting callback,
> which calls rtrequest(RTM_DELETE, ...) from within the tree iteration in
> rn_walktree. Although rn_walktree protects itself from deletion of the current
> node while iterating, there is no protection if the *next* node is deleted
> during the callback. This can happen if the called node is a route and there 
> is
> a clone of it following it in the iteration sequence. That is because
> rtrequest1, in the RTM_DELETE case, will call rtflushclone, and this will
> delete the cloned route. Upon return to rn_walktree, the next node may be
> deleted, but rn_walktree will dereference it.

I am pretty sure that this is fixed in -current.

Dave

-- 
David Young             OJC Technologies
dyoung%ojctech.com@localhost      Urbana, IL * (217) 344-0444 x24