[src/trunk]: src/sys/netinet6 Fix rtfree in nd6_output

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f05fb3813a22
branches:  trunk
changeset: 810529:f05fb3813a22
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Thu Sep 03 00:54:39 2015 +0000

description:
Fix rtfree in nd6_output

We have to check and avoid to rtfree the original rtentry passed to
nd6_output even when manipulating gateway routes.

This fixes panic on assertion "ro->_ro_rt ==NULL || ro->_ro_rt->rt_refcnt > 0"
failure and probably PR kern/50161.

diffstat:

 sys/netinet6/nd6.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (33 lines):

diff -r e1dfba443936 -r f05fb3813a22 sys/netinet6/nd6.c
--- a/sys/netinet6/nd6.c        Wed Sep 02 23:03:41 2015 +0000
+++ b/sys/netinet6/nd6.c        Thu Sep 03 00:54:39 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nd6.c,v 1.174 2015/09/02 11:35:11 ozaki-r Exp $        */
+/*     $NetBSD: nd6.c,v 1.175 2015/09/03 00:54:39 ozaki-r Exp $        */
 /*     $KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $   */
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.174 2015/09/02 11:35:11 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.175 2015/09/03 00:54:39 ozaki-r Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_net_mpsafe.h"
@@ -2212,12 +2212,12 @@
                        RTFREE_IF_NEEDED(rt);
                        rt = gwrt;
                        if ((rt->rt_flags & RTF_UP) == 0) {
-                               rtfree(rt);
+                               RTFREE_IF_NEEDED(rt);
                                rt = rt0;
                        lookup:
                                gwrt = rtalloc1(rt->rt_gateway, 1);
                                rt_set_gwroute(rt, gwrt);
-                               rtfree(rt);
+                               RTFREE_IF_NEEDED(rt);
                                rt = gwrt;
                                if (rt == NULL)
                                        senderr(EHOSTUNREACH);