From 27e02ab7e186235a6dcb88013ea5d20b57b22979 Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Wed, 7 Oct 2015 08:43:36 +0000
Subject: [PATCH] Move the reference counting of a newly created route entry
 inside rtable_insert().

inputs and ok bluhm@
---
 sys/net/route.c  | 14 ++++++++------
 sys/net/rtable.c |  6 +++++-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/sys/net/route.c b/sys/net/route.c
index 20c96d8733a..5c4da5c46e7 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.246 2015/10/01 22:21:48 mpi Exp $	*/
+/*	$OpenBSD: route.c,v 1.247 2015/10/07 08:43:36 mpi Exp $	*/
 /*	$NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $	*/
 
 /*
@@ -1090,7 +1090,7 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 				error = rtable_insert(tableid, ndst,
 				    info->rti_info[RTAX_NETMASK],
 				    rt->rt_priority, rt);
-				}
+			}
 			rtfree(crt);
 		}
 		if (error != 0) {
@@ -1108,10 +1108,7 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 
 		if (ifa->ifa_rtrequest)
 			ifa->ifa_rtrequest(req, rt);
-		if (ret_nrt) {
-			*ret_nrt = rt;
-			rt->rt_refcnt++;
-		}
+
 		if ((rt->rt_flags & RTF_CLONING) != 0) {
 			/* clean up any cloned children */
 			rtflushclone(tableid, rt);
@@ -1119,6 +1116,11 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 
 		if_group_routechange(info->rti_info[RTAX_DST],
 			info->rti_info[RTAX_NETMASK]);
+
+		if (ret_nrt != NULL)
+			*ret_nrt = rt;
+		else
+			rtfree(rt);
 		break;
 	}
 
diff --git a/sys/net/rtable.c b/sys/net/rtable.c
index 87268b7ed6d..0b335c35cb0 100644
--- a/sys/net/rtable.c
+++ b/sys/net/rtable.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtable.c,v 1.8 2015/09/28 08:47:53 mpi Exp $ */
+/*	$OpenBSD: rtable.c,v 1.9 2015/10/07 08:43:36 mpi Exp $ */
 
 /*
  * Copyright (c) 2014-2015 Martin Pieuchot
@@ -109,6 +109,9 @@ rtable_insert(unsigned int rtableid, struct sockaddr *dst,
 	if (rn == NULL)
 		return (ESRCH);
 
+	rt = ((struct rtentry *)rn);
+	rtref(rt);
+
 	return (0);
 }
 
@@ -418,6 +421,7 @@ rtable_insert(unsigned int rtableid, struct sockaddr *dst,
 		rt->rt_mask = msk;
 	}
 
+	rtref(rt);
 	LIST_INSERT_HEAD(&an->an_rtlist, rt, rt_next);
 
 #ifndef SMALL_KERNEL
-- 
2.20.1