Between the calls to art_match() and SRPL_FIRST() another CPU may

remove the route from the list.  In rtable_match() check if the
route entry is NULL.
discussed with mpi@ jmatthew@ claudio@; OK mpi@

diff --git a/sys/net/rtable.c b/sys/net/rtable.c
index 6a5f022..90207ae 100644 (file)
--- a/sys/net/rtable.c
+++ b/sys/net/rtable.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: rtable.c,v 1.79 2022/06/28 10:01:13 bluhm Exp $ */
+/*     $OpenBSD: rtable.c,v 1.80 2022/06/29 22:20:47 bluhm Exp $ */
 
 /*
  * Copyright (c) 2014-2016 Martin Pieuchot
@@ -486,6 +486,10 @@ rtable_match(unsigned int rtableid, struct sockaddr *dst, uint32_t *src)
                goto out;
 
        rt = SRPL_FIRST(&sr, &an->an_rtlist);
+       if (rt == NULL) {
+               SRPL_LEAVE(&sr);
+               goto out;
+       }
        rtref(rt);
        SRPL_LEAVE(&sr);