From ba00f3f67464177809bb72c3cc1d43d7ab120f94 Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Mon, 22 Jun 2015 09:07:11 +0000
Subject: [PATCH] rtrequest1(9) error code path cleanup.

Pass the length to free(9), do not violate the radix/route layer and
set the gateway of a route a bit later to simplify error code path.

ok claudio@
---
 sys/net/route.c | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/sys/net/route.c b/sys/net/route.c
index 88e8134dc2e..b2ac61f1b03 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.213 2015/06/06 09:31:53 mpi Exp $	*/
+/*	$OpenBSD: route.c,v 1.214 2015/06/22 09:07:11 mpi Exp $	*/
 /*	$NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $	*/
 
 /*
@@ -862,14 +862,14 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 			    info->rti_info[RTAX_NETMASK],
 			    info->rti_info[RTAX_GATEWAY], prio,
 			    info->rti_flags & RTF_MPATH)) {
-				free(ndst, M_RTABLE, 0);
+				free(ndst, M_RTABLE, dlen);
 				return (EEXIST);
 			}
 		}
 #endif
 		rt = pool_get(&rtentry_pool, PR_NOWAIT | PR_ZERO);
 		if (rt == NULL) {
-			free(ndst, M_RTABLE, 0);
+			free(ndst, M_RTABLE, dlen);
 			return (ENOBUFS);
 		}
 
@@ -877,14 +877,6 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 		rt->rt_tableid = tableid;
 		rt->rt_priority = prio;	/* init routing priority */
 		LIST_INIT(&rt->rt_timer);
-		rt->rt_nodes->rn_key = (caddr_t)ndst;
-
-		if ((error = rt_setgate(rt, info->rti_info[RTAX_GATEWAY],
-		    tableid))) {
-			free(ndst, M_RTABLE, 0);
-			pool_put(&rtentry_pool, rt);
-			return (error);
-		}
 
 #ifndef SMALL_KERNEL
 		if (rn_mpath_capable(rnh)) {
@@ -919,11 +911,7 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 			    M_TEMP, M_NOWAIT|M_ZERO);
 
 			if (rt->rt_llinfo == NULL) {
-				if (rt->rt_gwroute)
-					rtfree(rt->rt_gwroute);
-				if (rt->rt_gateway)
-					free(rt->rt_gateway, M_RTABLE, 0);
-				free(rt_key(rt), M_RTABLE, 0);
+				free(ndst, M_RTABLE, dlen);
 				pool_put(&rtentry_pool, rt);
 				return (ENOMEM);
 			}
@@ -974,6 +962,19 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 			rt->rt_parent = *ret_nrt;	 /* Back ptr. to parent. */
 			rt->rt_parent->rt_refcnt++;
 		}
+
+		/*
+		 * We must set rt->rt_gateway before adding ``rt'' to
+		 * the routing table because the radix MPATH code use
+		 * it to (re)order routes.
+		 */
+		if ((error = rt_setgate(rt, info->rti_info[RTAX_GATEWAY],
+		    tableid))) {
+			free(ndst, M_RTABLE, dlen);
+			pool_put(&rtentry_pool, rt);
+			return (error);
+		}
+
 		rn = rnh->rnh_addaddr((caddr_t)ndst,
 		    (caddr_t)info->rti_info[RTAX_NETMASK], rnh, rt->rt_nodes,
 		    rt->rt_priority);
@@ -995,7 +996,7 @@ rtrequest1(int req, struct rt_addrinfo *info, u_int8_t prio,
 				rtfree(rt->rt_gwroute);
 			if (rt->rt_gateway)
 				free(rt->rt_gateway, M_RTABLE, 0);
-			free(rt_key(rt), M_RTABLE, 0);
+			free(ndst, M_RTABLE, dlen);
 			pool_put(&rtentry_pool, rt);
 			return (EEXIST);
 		}
-- 
2.20.1