If the caller of rtrequest*(RTM_DELETE, ...) asked for a copy of

the entry being removed (ret_nrt != NULL), increment the entry's
rt_refcnt like we do it for RTM_ADD and RTM_RESOLVE, rather than
messing around with 1->0 transitions for rtfree() all over.

2 files changed, 6 insertions, 19 deletions

diff --git a/sys/net/route.c b/sys/net/route.c
index 260f375..41f1335 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -566,6 +566,8 @@ rtrequest1(req, info, ret_nrt)
 		if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT))
 			panic ("rtrequest delete");
 		rt = (struct rtentry *)rn;
+		rt->rt_refcnt++;
+		rt->rt_flags &= ~RTF_UP;
 
 		/*
 		 * Now search what's left of the subtree for any cloned
@@ -589,15 +591,6 @@ rtrequest1(req, info, ret_nrt)
 		}
 
 		/*
-		 * NB: RTF_UP must be set during the search above,
-		 * because we might delete the last ref, causing
-		 * rt to get freed prematurely.
-		 *  eh? then why not just add a reference?
-		 * I'm not sure how RTF_UP helps matters. (JRE)
-		 */
-		rt->rt_flags &= ~RTF_UP;
-
-		/*
 		 * give the protocol a chance to keep things in sync.
 		 */
 		if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)
@@ -616,10 +609,8 @@ rtrequest1(req, info, ret_nrt)
 		 */
 		if (ret_nrt)
 			*ret_nrt = rt;
-		else if (rt->rt_refcnt <= 0) {
-			rt->rt_refcnt++; /* make a 1->0 transition */
-			rtfree(rt);
-		}
+		else
+			RTFREE(rt);
 		break;
 
 	case RTM_RESOLVE:
@@ -1137,10 +1128,7 @@ bad:
 			 * If we are deleting, and we found an entry, then
 			 * it's been removed from the tree.. now throw it away.
 			 */
-			if (rt->rt_refcnt <= 0) {
-				rt->rt_refcnt++; /* make a 1->0 transition */
-				rtfree(rt);
-			}
+			RTFREE(rt);
 		} else if (cmd == RTM_ADD) {
 			/*
 			 * We just wanted to add it.. we don't actually
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index 0c441ef..25276d7 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -356,8 +356,7 @@ route_output(m, so)
 	case RTM_DELETE:
 		error = rtrequest1(RTM_DELETE, &info, &saved_nrt);
 		if (error == 0) {
-			if ((rt = saved_nrt))
-				rt->rt_refcnt++;
+			rt = saved_nrt;
 			goto report;
 		}
 		break;