fix a reported panic when adding a route and one hit here when deleting a route

- pass RTF_RNH_LOCKED to rtalloc1_fib in 2 cases where the lock is held
- make sure the rnh lock is held across rt_setgate and rt_getifa_fib

2 files changed, 12 insertions, 4 deletions

diff --git a/sys/net/route.c b/sys/net/route.c
index 365ec1e..be71e13 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -680,7 +680,7 @@ ifa_ifwithroute_fib(int flags, struct sockaddr *dst, struct sockaddr *gateway,
 	if (ifa == NULL)
 		ifa = ifa_ifwithnet(gateway);
 	if (ifa == NULL) {
-		struct rtentry *rt = rtalloc1_fib(gateway, 0, 0UL, fibnum);
+		struct rtentry *rt = rtalloc1_fib(gateway, 0, RTF_RNH_LOCKED, fibnum);
 		if (rt == NULL)
 			return (NULL);
 		/*
@@ -1161,7 +1161,7 @@ deldone:
 			 * then we just blow it away and retry the insertion
 			 * of the new one.
 			 */
-			rt2 = rtalloc1_fib(dst, 0, 0, fibnum);
+			rt2 = rtalloc1_fib(dst, 0, RTF_RNH_LOCKED, fibnum);
 			if (rt2 && rt2->rt_parent) {
 				rtexpunge(rt2);
 				RT_UNLOCK(rt2);
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index 03bf7fa..e8cc021 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -672,9 +672,11 @@ route_output(struct mbuf *m, struct socket *so)
 			     !sa_equal(info.rti_info[RTAX_IFA],
 				       rt->rt_ifa->ifa_addr))) {
 				RT_UNLOCK(rt);
+				RADIX_NODE_HEAD_LOCK(rnh);
 				if ((error = rt_getifa_fib(&info,
 				    rt->rt_fibnum)) != 0)
 					senderr(error);
+				RADIX_NODE_HEAD_UNLOCK(rnh);
 				RT_LOCK(rt);
 			}
 			if (info.rti_ifa != NULL &&
@@ -686,8 +688,14 @@ route_output(struct mbuf *m, struct socket *so)
 				IFAFREE(rt->rt_ifa);
 			}
 			if (info.rti_info[RTAX_GATEWAY] != NULL) {
-				if ((error = rt_setgate(rt, rt_key(rt),
-					info.rti_info[RTAX_GATEWAY])) != 0) {
+				RT_UNLOCK(rt);
+				RADIX_NODE_HEAD_LOCK(rnh);
+				RT_LOCK(rt);
+				
+				error = rt_setgate(rt, rt_key(rt),
+				    info.rti_info[RTAX_GATEWAY]);
+				RADIX_NODE_HEAD_UNLOCK(rnh);
+				if (error != 0) {
 					RT_UNLOCK(rt);
 					senderr(error);
 				}