misc/159601: [patch] in_scrubprefix() - loopback route refcount malfunction

[Svatopluk Kraus]

>Number:         159601
>Category:       misc
>Synopsis:       [patch] in_scrubprefix() - loopback route refcount malfunction
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug 08 13:00:28 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Svatopluk Kraus
>Release:        current
>Organization:
>Environment:
>Description:
Loopback route for same source address (two NIC with same source address) is refcounted in in_ifinit(). In in_ifscrubprefix(), a loopback route is deleted only if LLE_STATIC flag is given but refcount always is process. It leads to inconsistency as during interface up and down cycle in_ifscrubprefix() is called without LLE_STATIC flag. I.e., loopback route should persist in routing table even if an interface is down. When same address is set on two interfaces, then if first one goes down and second one deletes the address, then loopback route is vanishing from routing table.
>How-To-Repeat:

>Fix:
Index: sys/netinet/in.c
===================================================================
--- sys/netinet/in.c	(revision 224705)
+++ sys/netinet/in.c	(working copy)
@@ -1126,7 +1126,7 @@
 			RT_LOCK(ia_ro.ro_rt);
 			if (ia_ro.ro_rt->rt_refcnt <= 1)
 				freeit = 1;
-			else
+			else if (flags & LLE_STATIC)
 				RT_REMREF(ia_ro.ro_rt);
 			RTFREE_LOCKED(ia_ro.ro_rt);
 		}


>Release-Note:
>Audit-Trail:
>Unformatted: