if_put after if_get for in6_src and ip6_output which got a lot easier after

all the cleanup by mpi@ since we no longer overwrite ifps, etc. OK dlg@

2 files changed, 38 insertions, 17 deletions

diff --git a/sys/netinet6/in6_src.c b/sys/netinet6/in6_src.c
index 4977868e96e..9212a19b75c 100644
--- a/sys/netinet6/in6_src.c
+++ b/sys/netinet6/in6_src.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_src.c,v 1.60 2015/09/11 19:23:00 mpi Exp $	*/
+/*	$OpenBSD: in6_src.c,v 1.61 2015/09/11 20:16:03 claudio Exp $	*/
 /*	$KAME: in6_src.c,v 1.36 2001/02/06 04:08:17 itojun Exp $	*/
 
 /*
@@ -127,6 +127,7 @@ in6_selectsrc(struct in6_addr **in6src, struct sockaddr_in6 *dstsock,
 
 		if (ifp && IN6_IS_SCOPE_EMBED(&sa6.sin6_addr))
 			sa6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
+		if_put(ifp); /* put reference from in6_selectif */
 
 		ia6 = ifatoia6(ifa_ifwithaddr(sin6tosa(&sa6), rtableid));
 		if (ia6 == NULL ||
@@ -159,6 +160,8 @@ in6_selectsrc(struct in6_addr **in6src, struct sockaddr_in6 *dstsock,
 			return (ENXIO); /* XXX: better error? */
 
 		ia6 = in6_ifawithscope(ifp, dst, rtableid);
+		if_put(ifp);
+
 		if (ia6 == NULL)
 			return (EADDRNOTAVAIL);
 
@@ -182,6 +185,8 @@ in6_selectsrc(struct in6_addr **in6src, struct sockaddr_in6 *dstsock,
 			return (ENXIO); /* XXX: better error? */
 
 		ia6 = in6_ifawithscope(ifp, dst, rtableid);
+		if_put(ifp);
+
 		if (ia6 == NULL)
 			return (EADDRNOTAVAIL);
 
@@ -204,6 +209,8 @@ in6_selectsrc(struct in6_addr **in6src, struct sockaddr_in6 *dstsock,
 
 		if (ifp) {
 			ia6 = in6_ifawithscope(ifp, dst, rtableid);
+			if_put(ifp);
+
 			if (ia6 == NULL)
 				return (EADDRNOTAVAIL);
 
@@ -459,7 +466,7 @@ in6_selectif(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts,
 	 * addresses.)
 	 */
 	if (rt && rt->rt_ifa && rt->rt_ifa->ifa_ifp)
-		*retifp = rt->rt_ifa->ifa_ifp;
+		*retifp = if_ref(rt->rt_ifa->ifa_ifp);
 
 	return (0);
 }
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 2d25636bd04..80c27a46edd 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_output.c,v 1.184 2015/09/11 19:23:00 mpi Exp $	*/
+/*	$OpenBSD: ip6_output.c,v 1.185 2015/09/11 20:16:03 claudio Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -550,7 +550,7 @@ reroute:
 			error = EHOSTUNREACH;
 			goto bad;
 		}
-		ifp = rt->rt_ifp;
+		ifp = if_ref(rt->rt_ifp);
 	} else {
 		*dst = dstsock;
 	}
@@ -734,6 +734,7 @@ reroute:
 		m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
 		finaldst = ip6->ip6_dst;
 		ro = NULL;
+		if_put(ifp); /* drop reference since destination changed */
 		goto reroute;
 	}
 #endif
@@ -894,6 +895,7 @@ reroute:
 		ip6stat.ip6s_fragmented++;
 
 done:
+	if_put(ifp);
 	if (ro == &ip6route && ro->ro_rt) {
 		rtfree(ro->ro_rt);
 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
@@ -2282,9 +2284,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 			break;
 		}
 		bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
-		if (ifindex == 0)
-			ifp = NULL;
-		else {
+		if (ifindex != 0) {
 			ifp = if_get(ifindex);
 			if (ifp == NULL) {
 				error = ENXIO;	/* XXX EINVAL? */
@@ -2292,8 +2292,10 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 			}
 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
 				error = EADDRNOTAVAIL;
+				if_put(ifp);
 				break;
 			}
+			if_put(ifp);
 		}
 		im6o->im6o_ifidx = ifindex;
 		break;
@@ -2383,7 +2385,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 				error = EADDRNOTAVAIL;
 				break;
 			}
-			ifp = ro.ro_rt->rt_ifp;
+			ifp = if_ref(ro.ro_rt->rt_ifp);
 			rtfree(ro.ro_rt);
 		} else {
 			/*
@@ -2401,6 +2403,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 		 * supports multicast
 		 */
 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
+			if_put(ifp);
 			error = EADDRNOTAVAIL;
 			break;
 		}
@@ -2421,6 +2424,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 			    &mreq->ipv6mr_multiaddr))
 				break;
 		if (imm != NULL) {
+			if_put(ifp);
 			error = EADDRINUSE;
 			break;
 		}
@@ -2429,6 +2433,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 		 * address list for the given interface.
 		 */
 		imm = in6_joingroup(ifp, &mreq->ipv6mr_multiaddr, &error);
+		if_put(ifp);
 		if (!imm)
 			break;
 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
@@ -2454,6 +2459,16 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 			error = EINVAL;
 			break;
 		}
+
+		/*
+		 * Put interface index into the multicast address,
+		 * if the address has link-local scope.
+		 */
+		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
+			mreq->ipv6mr_multiaddr.s6_addr16[1] =
+			    htons(mreq->ipv6mr_interface);
+		}
+
 		/*
 		 * If an interface address was specified, get a pointer
 		 * to its ifnet structure.
@@ -2469,14 +2484,6 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 		}
 
 		/*
-		 * Put interface index into the multicast address,
-		 * if the address has link-local scope.
-		 */
-		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
-			mreq->ipv6mr_multiaddr.s6_addr16[1] =
-			    htons(mreq->ipv6mr_interface);
-		}
-		/*
 		 * Find the membership in the membership list.
 		 */
 		LIST_FOREACH(imm, &im6o->im6o_memberships, i6mm_chain) {
@@ -2486,6 +2493,9 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 			    &mreq->ipv6mr_multiaddr))
 				break;
 		}
+
+		if_put(ifp);
+
 		if (imm == NULL) {
 			/* Unable to resolve interface */
 			error = EADDRNOTAVAIL;
@@ -2733,6 +2743,7 @@ ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
 			ifp = if_get(pktinfo->ipi6_ifindex);
 			if (ifp == NULL)
 				return (ENXIO);
+			if_put(ifp);
 		}
 
 		/*
@@ -2818,8 +2829,11 @@ ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
 				return (EINVAL);
 			}
 			if (IN6_IS_SCOPE_EMBED(&sa6->sin6_addr)) {
-				if (if_get(sa6->sin6_scope_id) == NULL)
+				struct ifnet *ifp;
+				ifp = if_get(sa6->sin6_scope_id);
+				if (ifp == NULL)
 					return (EINVAL);
+				if_put(ifp);
 				sa6->sin6_addr.s6_addr16[1] =
 				    htonl(sa6->sin6_scope_id);
 			} else if (sa6->sin6_scope_id)