From nobody@FreeBSD.org  Mon Aug  8 12:54:44 2011
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 64BC4106566B
	for <freebsd-gnats-submit@FreeBSD.org>; Mon,  8 Aug 2011 12:54:44 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id 543728FC14
	for <freebsd-gnats-submit@FreeBSD.org>; Mon,  8 Aug 2011 12:54:44 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p78CsiqE078860
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 8 Aug 2011 12:54:44 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.4/8.14.4/Submit) id p78CsiNh078859;
	Mon, 8 Aug 2011 12:54:44 GMT
	(envelope-from nobody)
Message-Id: <201108081254.p78CsiNh078859@red.freebsd.org>
Date: Mon, 8 Aug 2011 12:54:44 GMT
From: Svatopluk Kraus <onwahe@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [patch] in_scrubprefix() - loopback route refcount malfunction
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         159601
>Category:       kern
>Synopsis:       [netinet] [patch] in_scrubprefix() - loopback route refcount malfunction
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug 08 13:00:28 UTC 2011
>Closed-Date:    
>Last-Modified:  Thu Oct 13 09:50:09 UTC 2011
>Originator:     Svatopluk Kraus
>Release:        current
>Organization:
>Environment:
>Description:
Loopback route for same source address (two NIC with same source address) is refcounted in in_ifinit(). In in_ifscrubprefix(), a loopback route is deleted only if LLE_STATIC flag is given but refcount always is process. It leads to inconsistency as during interface up and down cycle in_ifscrubprefix() is called without LLE_STATIC flag. I.e., loopback route should persist in routing table even if an interface is down. When same address is set on two interfaces, then if first one goes down and second one deletes the address, then loopback route is vanishing from routing table.
>How-To-Repeat:

>Fix:
Index: sys/netinet/in.c
===================================================================
--- sys/netinet/in.c	(revision 224705)
+++ sys/netinet/in.c	(working copy)
@@ -1126,7 +1126,7 @@
 			RT_LOCK(ia_ro.ro_rt);
 			if (ia_ro.ro_rt->rt_refcnt <= 1)
 				freeit = 1;
-			else
+			else if (flags & LLE_STATIC)
 				RT_REMREF(ia_ro.ro_rt);
 			RTFREE_LOCKED(ia_ro.ro_rt);
 		}


>Release-Note:
>Audit-Trail:

From: Svatopluk Kraus <onwahe@gmail.com>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: misc/159601: [patch] in_scrubprefix() - loopback route refcount malfunction
Date: Tue, 9 Aug 2011 16:07:53 +0200

 I'm sorry, the category should be [kern] and correct patch is following:
 
 Index: sys/netinet/in.c
 ===================================================================
 --- sys/netinet/in.c	(revision 224705)
 +++ sys/netinet/in.c	(working copy)
 @@ -1126,8 +1126,10 @@
  			RT_LOCK(ia_ro.ro_rt);
  			if (ia_ro.ro_rt->rt_refcnt <= 1)
  				freeit = 1;
 -			else
 +			else if (flags & LLE_STATIC) {
  				RT_REMREF(ia_ro.ro_rt);
 +				target->ia_flags &= ~IFA_RTSELF;
 +			}
  			RTFREE_LOCKED(ia_ro.ro_rt);
  		}
  		if (freeit && (flags & LLE_STATIC)) {
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Wed Aug 10 00:27:54 UTC 2011 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=159601 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/159601: commit references a PR
Date: Fri,  7 Oct 2011 18:01:51 +0000 (UTC)

 Author: qingli
 Date: Fri Oct  7 18:01:34 2011
 New Revision: 226114
 URL: http://svn.freebsd.org/changeset/base/226114
 
 Log:
   Remove the reference held on the loopback route when the interface
   address is being deleted. Only the last reference holder deletes the
   loopback route. All other delete operations just clear the IFA_RTSELF
   flag.
   
   PR:		kern/159601
   Submitted by:	pluknet
   Reviewed by:	discussed on net@
   MFC after:	3 days
 
 Modified:
   head/sys/netinet/in.c
 
 Modified: head/sys/netinet/in.c
 ==============================================================================
 --- head/sys/netinet/in.c	Fri Oct  7 16:39:03 2011	(r226113)
 +++ head/sys/netinet/in.c	Fri Oct  7 18:01:34 2011	(r226114)
 @@ -1126,8 +1126,10 @@ in_scrubprefix(struct in_ifaddr *target,
  			RT_LOCK(ia_ro.ro_rt);
  			if (ia_ro.ro_rt->rt_refcnt <= 1)
  				freeit = 1;
 -			else
 +			else if (flags & LLE_STATIC) {
  				RT_REMREF(ia_ro.ro_rt);
 +				target->ia_flags &= ~IFA_RTSELF;
 +			}
  			RTFREE_LOCKED(ia_ro.ro_rt);
  		}
  		if (freeit && (flags & LLE_STATIC)) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/159601: commit references a PR
Date: Mon, 10 Oct 2011 21:41:43 +0000 (UTC)

 Author: qingli
 Date: Mon Oct 10 21:41:34 2011
 New Revision: 226237
 URL: http://svn.freebsd.org/changeset/base/226237
 
 Log:
   MFC 226114
   
   Remove the reference held on the loopback route when the interface
   address is being deleted. Only the last reference holder deletes the
   loopback route. All other delete operations just clear the IFA_RTSELF
   flag.
   
   PR:		kern/159601
   Submitted by:	pluknet
   Reviewed by:	discussed on net@
 
 Modified:
   stable/8/sys/netinet/in.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/amd64/include/xen/   (props changed)
   stable/8/sys/cddl/contrib/opensolaris/   (props changed)
   stable/8/sys/contrib/dev/acpica/   (props changed)
   stable/8/sys/contrib/pf/   (props changed)
 
 Modified: stable/8/sys/netinet/in.c
 ==============================================================================
 --- stable/8/sys/netinet/in.c	Mon Oct 10 21:38:19 2011	(r226236)
 +++ stable/8/sys/netinet/in.c	Mon Oct 10 21:41:34 2011	(r226237)
 @@ -1126,8 +1126,10 @@ in_scrubprefix(struct in_ifaddr *target,
  			RT_LOCK(ia_ro.ro_rt);
  			if (ia_ro.ro_rt->rt_refcnt <= 1)
  				freeit = 1;
 -			else
 +			else if (flags & LLE_STATIC) {
  				RT_REMREF(ia_ro.ro_rt);
 +				target->ia_flags &= ~IFA_RTSELF;
 +			}
  			RTFREE_LOCKED(ia_ro.ro_rt);
  		}
  		if (freeit && (flags & LLE_STATIC)) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/159601: commit references a PR
Date: Thu, 13 Oct 2011 08:26:35 +0000 (UTC)

 Author: qingli
 Date: Thu Oct 13 08:26:23 2011
 New Revision: 226333
 URL: http://svn.freebsd.org/changeset/base/226333
 
 Log:
   MFC 226114
   
   Remove the reference held on the loopback route when the interface
   address is being deleted. Only the last reference holder deletes the
   loopback route. All other delete operations just clear the IFA_RTSELF
   flag.
   
   PR:		kern/159601
   Submitted by:	pluknet
   Reviewed by:	discussed on net@
   Approved by:	re (kib)
 
 Modified:
   stable/9/sys/netinet/in.c
 Directory Properties:
   stable/9/sys/   (props changed)
   stable/9/sys/amd64/include/xen/   (props changed)
   stable/9/sys/boot/   (props changed)
   stable/9/sys/boot/i386/efi/   (props changed)
   stable/9/sys/boot/ia64/efi/   (props changed)
   stable/9/sys/boot/ia64/ski/   (props changed)
   stable/9/sys/boot/powerpc/boot1.chrp/   (props changed)
   stable/9/sys/boot/powerpc/ofw/   (props changed)
   stable/9/sys/cddl/contrib/opensolaris/   (props changed)
   stable/9/sys/conf/   (props changed)
   stable/9/sys/contrib/dev/acpica/   (props changed)
   stable/9/sys/contrib/octeon-sdk/   (props changed)
   stable/9/sys/contrib/pf/   (props changed)
   stable/9/sys/contrib/x86emu/   (props changed)
 
 Modified: stable/9/sys/netinet/in.c
 ==============================================================================
 --- stable/9/sys/netinet/in.c	Thu Oct 13 03:21:48 2011	(r226332)
 +++ stable/9/sys/netinet/in.c	Thu Oct 13 08:26:23 2011	(r226333)
 @@ -1126,8 +1126,10 @@ in_scrubprefix(struct in_ifaddr *target,
  			RT_LOCK(ia_ro.ro_rt);
  			if (ia_ro.ro_rt->rt_refcnt <= 1)
  				freeit = 1;
 -			else
 +			else if (flags & LLE_STATIC) {
  				RT_REMREF(ia_ro.ro_rt);
 +				target->ia_flags &= ~IFA_RTSELF;
 +			}
  			RTFREE_LOCKED(ia_ro.ro_rt);
  		}
  		if (freeit && (flags & LLE_STATIC)) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: Svatopluk Kraus <onwahe@gmail.com>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/159601: [netinet] [patch] in_scrubprefix() - loopback route
 refcount malfunction
Date: Thu, 13 Oct 2011 11:19:07 +0200

 Thanks for commit. I think the PR can be closed.
>Unformatted:
