kern/156283: nd6_ns_input - rtalloc_mpath does not return a locked rtentry

[Ingo Flaschberger]

>Number:         156283
>Category:       kern
>Synopsis:       nd6_ns_input - rtalloc_mpath does not return a locked rtentry
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 08 19:10:09 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Ingo Flaschberger
>Release:        FreeBSD 8.2-RELEASE
>Organization:
crossip communications gmbh
>Environment:
>Description:
Problem occurs when RADIX_MPATH is defined.

In nd6_ns_input rtalloc_mpath does not return a locked root.
Panic occurs when RTFREE_LOCKED(rt); is called at this route.

>How-To-Repeat:

>Fix:


Patch attached with submission follows:

--- nd6_nbr.c_org	2011-03-21 09:40:01.000000000 +0000
+++ nd6_nbr.c	2011-04-08 18:57:18.000000000 +0000
@@ -257,7 +257,11 @@
 			 */
 			if (need_proxy)
 				proxydl = *SDL(rt->rt_gateway);
+#ifdef RADIX_MPATH
+			RTFREE(rt);	/* rtalloc_mpath does not return a locked route */
+#else
 			RTFREE_LOCKED(rt);
+#endif
 		}
 		if (need_proxy) {
 			/*


>Release-Note:
>Audit-Trail:
>Unformatted: