Fix route entry leak.

In in6_ifdetach() two struct rtentry were leaked.  This was triggered
by regress/sbin/route and detected with btrace(8) refcnt.  The
reference returned by rtalloc() must be freed with rtfree() in all
cases.

OK phessler@ mvs@

diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c
index 49b8bc7..3d7ced8 100644 (file)
--- a/sys/netinet6/in6_ifattach.c
+++ b/sys/netinet6/in6_ifattach.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: in6_ifattach.c,v 1.121 2022/11/15 18:42:46 claudio Exp $      */
+/*     $OpenBSD: in6_ifattach.c,v 1.122 2023/07/09 19:06:48 bluhm Exp $        */
 /*     $KAME: in6_ifattach.c,v 1.124 2001/07/18 08:32:51 jinmei Exp $  */
 
 /*
@@ -440,10 +440,9 @@ in6_ifdetach(struct ifnet *ifp)
        sin6.sin6_addr = in6addr_intfacelocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-       if (rt && rt->rt_ifidx == ifp->if_index) {
+       if (rt && rt->rt_ifidx == ifp->if_index)
                rtdeletemsg(rt, ifp, ifp->if_rdomain);
-               rtfree(rt);
-       }
+       rtfree(rt);
 
        /* remove route to link-local allnodes multicast (ff02::1) */
        bzero(&sin6, sizeof(sin6));
@@ -452,10 +451,9 @@ in6_ifdetach(struct ifnet *ifp)
        sin6.sin6_addr = in6addr_linklocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-       if (rt && rt->rt_ifidx == ifp->if_index) {
+       if (rt && rt->rt_ifidx == ifp->if_index)
                rtdeletemsg(rt, ifp, ifp->if_rdomain);
-               rtfree(rt);
-       }
+       rtfree(rt);
 
        if (ifp->if_xflags & (IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP))
                ifp->if_xflags &= ~(IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP);