d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

During a flood, we don't call rtfree(), but we remove the entry ourselves.

Browse Source 
However, if the RTF_DELCLONE and RTF_WASCLONED condition passes, but the ref
count is > 1, we won't decrement the count at all. This could lead to
route entries never being deleted.

Here, we call rtfree() not only if the initial two conditions fail, but
also if the ref count is > 1 (and we therefore don't immediately delete
the route, but let rtfree() handle it).

This is an urgent MFC candidate. Thanks go to Mike Silbersack for the
fix, once again. :-)

Submitted by: Mike Silbersack <silby@silby.com>
This commit is contained in:
bmilekic 2001-03-04 21:28:40 +00:00
parent ea9cbc5d18
commit 88ef993e5e
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sys/netinet/in_pcb.c
View File

@ -562,19 +562,13 @@ in_pcbdetach(inp)
* route deletion requires reference count to be <= zero * route deletion requires reference count to be <= zero
*/ */
if ((rt->rt_flags & RTF_DELCLONE) && if ((rt->rt_flags & RTF_DELCLONE) &&
(rt->rt_flags & RTF_WASCLONED)) { (rt->rt_flags & RTF_WASCLONED) &&
if (--rt->rt_refcnt <= 0) { (rt->rt_refcnt <= 1)) {
rt->rt_flags &= ~RTF_UP; rt->rt_refcnt--;
rtrequest(RTM_DELETE, rt_key(rt), rt->rt_flags &= ~RTF_UP;
rt->rt_gateway, rt_mask(rt), rtrequest(RTM_DELETE, rt_key(rt),
rt->rt_flags, (struct rtentry **)0); rt->rt_gateway, rt_mask(rt),
} rt->rt_flags, (struct rtentry **)0);
else
/*
* more than one reference, bump it up
* again.
*/
rt->rt_refcnt++;
} }
else else
rtfree(rt); rtfree(rt);