From: bluhm <bluhm@openbsd.org>
Date: Sun, 9 Jul 2023 19:06:48 +0000 (+0000)
Subject: Fix route entry leak.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=ec216fe2d2cefdfbf22c1e7aa0935c00cddfd627;p=openbsd

Fix route entry leak.

In in6_ifdetach() two struct rtentry were leaked.  This was triggered
by regress/sbin/route and detected with btrace(8) refcnt.  The
reference returned by rtalloc() must be freed with rtfree() in all
cases.

OK phessler@ mvs@
---

diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c
index 49b8bc76c35..3d7ced8f752 100644
--- a/sys/netinet6/in6_ifattach.c
+++ b/sys/netinet6/in6_ifattach.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_ifattach.c,v 1.121 2022/11/15 18:42:46 claudio Exp $	*/
+/*	$OpenBSD: in6_ifattach.c,v 1.122 2023/07/09 19:06:48 bluhm Exp $	*/
 /*	$KAME: in6_ifattach.c,v 1.124 2001/07/18 08:32:51 jinmei Exp $	*/
 
 /*
@@ -440,10 +440,9 @@ in6_ifdetach(struct ifnet *ifp)
 	sin6.sin6_addr = in6addr_intfacelocal_allnodes;
 	sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
 	rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-	if (rt && rt->rt_ifidx == ifp->if_index) {
+	if (rt && rt->rt_ifidx == ifp->if_index)
 		rtdeletemsg(rt, ifp, ifp->if_rdomain);
-		rtfree(rt);
-	}
+	rtfree(rt);
 
 	/* remove route to link-local allnodes multicast (ff02::1) */
 	bzero(&sin6, sizeof(sin6));
@@ -452,10 +451,9 @@ in6_ifdetach(struct ifnet *ifp)
 	sin6.sin6_addr = in6addr_linklocal_allnodes;
 	sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
 	rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-	if (rt && rt->rt_ifidx == ifp->if_index) {
+	if (rt && rt->rt_ifidx == ifp->if_index)
 		rtdeletemsg(rt, ifp, ifp->if_rdomain);
-		rtfree(rt);
-	}
+	rtfree(rt);
 
 	if (ifp->if_xflags & (IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP))
 		ifp->if_xflags &= ~(IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP);