The branch releng/13.0 has been updated by melifaro:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=3765afa4dacf5850de984fede7f9b26760efac73

commit 3765afa4dacf5850de984fede7f9b26760efac73
Author:     Alexander V. Chernikov <melif...@freebsd.org>
AuthorDate: 2021-03-23 22:00:04 +0000
Commit:     Alexander V. Chernikov <melif...@freebsd.org>
CommitDate: 2021-03-28 20:40:48 +0000

    Fix panic when destroying interface with ECMP routes.
    
    Reported by:    Zhenlei Huang <zlei.huang at gmail.com>
    PR:             254496
    Approved by:    re (gjb)
    
    (cherry picked from commit af85312e8a6f34ea7c8af77b9841fab6b5559e25)
---
 sys/net/route/route_ctl.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/sys/net/route/route_ctl.c b/sys/net/route/route_ctl.c
index 46e0bcfee6b7..58b89c28f945 100644
--- a/sys/net/route/route_ctl.c
+++ b/sys/net/route/route_ctl.c
@@ -130,16 +130,25 @@ vnet_rtzone_destroy()
 static void
 destroy_rtentry(struct rtentry *rt)
 {
+       struct nhop_object *nh = rt->rt_nhop;
 
        /*
         * At this moment rnh, nh_control may be already freed.
         * nhop interface may have been migrated to a different vnet.
         * Use vnet stored in the nexthop to delete the entry.
         */
-       CURVNET_SET(nhop_get_vnet(rt->rt_nhop));
+#ifdef ROUTE_MPATH
+       if (NH_IS_NHGRP(nh)) {
+               struct weightened_nhop *wn;
+               uint32_t num_nhops;
+               wn = nhgrp_get_nhops((struct nhgrp_object *)nh, &num_nhops);
+               nh = wn[0].nh;
+       }
+#endif
+       CURVNET_SET(nhop_get_vnet(nh));
 
        /* Unreference nexthop */
-       nhop_free_any(rt->rt_nhop);
+       nhop_free_any(nh);
 
        uma_zfree(V_rtzone, rt);
 
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"

Reply via email to