Index: sys/arch/amd64/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/amd64/conf/GENERIC.MP,v diff -u -p -u -p -r1.16 GENERIC.MP --- sys/arch/amd64/conf/GENERIC.MP 9 Feb 2021 14:06:19 -0000 1.16 +++ sys/arch/amd64/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -4,6 +4,6 @@ include "arch/amd64/conf/GENERIC" option MULTIPROCESSOR #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/arch/arm64/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/arm64/conf/GENERIC.MP,v diff -u -p -u -p -r1.5 GENERIC.MP --- sys/arch/arm64/conf/GENERIC.MP 1 Jul 2018 21:05:07 -0000 1.5 +++ sys/arch/arm64/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -4,6 +4,6 @@ include "arch/arm64/conf/GENERIC" option MULTIPROCESSOR #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/arch/i386/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/i386/conf/GENERIC.MP,v diff -u -p -u -p -r1.11 GENERIC.MP --- sys/arch/i386/conf/GENERIC.MP 3 Jun 2018 05:18:33 -0000 1.11 +++ sys/arch/i386/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -7,6 +7,6 @@ include "arch/i386/conf/GENERIC" option MULTIPROCESSOR # Multiple processor support #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/arch/macppc/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/macppc/conf/GENERIC.MP,v diff -u -p -u -p -r1.2 GENERIC.MP --- sys/arch/macppc/conf/GENERIC.MP 15 Apr 2020 08:09:33 -0000 1.2 +++ sys/arch/macppc/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -4,6 +4,6 @@ include "arch/macppc/conf/GENERIC" option MULTIPROCESSOR #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/arch/powerpc64/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/powerpc64/conf/GENERIC.MP,v diff -u -p -u -p -r1.1 GENERIC.MP --- sys/arch/powerpc64/conf/GENERIC.MP 21 Jul 2020 21:38:31 -0000 1.1 +++ sys/arch/powerpc64/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -4,6 +4,6 @@ include "arch/powerpc64/conf/GENERIC" option MULTIPROCESSOR #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/arch/riscv64/conf/GENERIC.MP =================================================================== RCS file: /mount/openbsd/cvs/src/sys/arch/riscv64/conf/GENERIC.MP,v diff -u -p -u -p -r1.1 GENERIC.MP --- sys/arch/riscv64/conf/GENERIC.MP 29 Jun 2021 21:27:52 -0000 1.1 +++ sys/arch/riscv64/conf/GENERIC.MP 10 Feb 2025 15:35:03 -0000 @@ -4,6 +4,6 @@ include "arch/riscv64/conf/GENERIC" option MULTIPROCESSOR #option MP_LOCKDEBUG -#option WITNESS +option WITNESS cpu* at mainbus? Index: sys/net/if_gre.c =================================================================== RCS file: /mount/openbsd/cvs/src/sys/net/if_gre.c,v diff -u -p -u -p -r1.179 if_gre.c --- sys/net/if_gre.c 4 Dec 2024 18:20:46 -0000 1.179 +++ sys/net/if_gre.c 10 Feb 2025 15:35:01 -0000 @@ -1633,7 +1633,7 @@ mgre_output(struct ifnet *ifp, struct mb { struct mgre_softc *sc = ifp->if_softc; struct sockaddr *gate; - struct rtentry *rt; + struct rtentry *rt = NULL; struct m_tag *mtag; int error = 0; sa_family_t af; @@ -1730,7 +1730,8 @@ mgre_output(struct ifnet *ifp, struct mb m = gre_l3_encap_dst(&sc->sc_tunnel, addr, m, dest->sa_family); if (m == NULL) { ifp->if_oerrors++; - return (ENOBUFS); + error = ENOBUFS; + goto out; } m->m_pkthdr.ph_family = dest->sa_family; @@ -1738,10 +1739,13 @@ mgre_output(struct ifnet *ifp, struct mb error = if_enqueue(ifp, m); if (error) ifp->if_oerrors++; +out: + rtfree(rt); return (error); drop: m_freem(m); + rtfree(rt); return (error); } Index: sys/net/route.c =================================================================== RCS file: /mount/openbsd/cvs/src/sys/net/route.c,v diff -u -p -u -p -r1.438 route.c --- sys/net/route.c 3 Jan 2025 21:27:40 -0000 1.438 +++ sys/net/route.c 10 Feb 2025 15:35:01 -0000 @@ -104,6 +104,7 @@ #include #include #include +#include #include #include #include @@ -324,10 +325,14 @@ rtisvalid(struct rtentry *rt) return (0); if (ISSET(rt->rt_flags, RTF_GATEWAY)) { - KASSERT(rt->rt_gwroute != NULL); - KASSERT(!ISSET(rt->rt_gwroute->rt_flags, RTF_GATEWAY)); - if (!ISSET(rt->rt_gwroute->rt_flags, RTF_UP)) - return (0); + int up; + + smr_read_enter(); + rt = SMR_PTR_GET(&rt->rt_gwroute); + KASSERT(!ISSET(rt->rt_flags, RTF_GATEWAY)); + up = ISSET(rt->rt_flags, RTF_UP) ? 1 : 0; + smr_read_leave(); + return (up); } return (1); @@ -595,13 +600,14 @@ rt_putgwroute(struct rtentry *rt, struct return; /* this is protected as per [X] in route.h */ - onhrt = rt->rt_gwroute; - rt->rt_gwroute = nhrt; + onhrt = SMR_PTR_GET_LOCKED(&rt->rt_gwroute); + SMR_PTR_SET_LOCKED(&rt->rt_gwroute, nhrt); if (onhrt != NULL) { KASSERT(onhrt->rt_cachecnt > 0); KASSERT(ISSET(onhrt->rt_flags, RTF_CACHED)); + smr_barrier(); --onhrt->rt_cachecnt; if (onhrt->rt_cachecnt == 0) CLR(onhrt->rt_flags, RTF_CACHED); @@ -1157,16 +1163,20 @@ rt_setgate(struct rtentry *rt, const str /* * Return the route entry containing the next hop link-layer - * address corresponding to ``rt''. + * address corresponding to ``rt''. The caller has to free. */ struct rtentry * rt_getll(struct rtentry *rt) { if (ISSET(rt->rt_flags, RTF_GATEWAY)) { - KASSERT(rt->rt_gwroute != NULL); - return (rt->rt_gwroute); + smr_read_enter(); + rt = SMR_PTR_GET(&rt->rt_gwroute); + rtref(rt); + smr_read_leave(); + return (rt); } + rtref(rt); return (rt); } Index: sys/netinet/if_ether.c =================================================================== RCS file: /mount/openbsd/cvs/src/sys/netinet/if_ether.c,v diff -u -p -u -p -r1.268 if_ether.c --- sys/netinet/if_ether.c 1 Jan 2025 13:44:22 -0000 1.268 +++ sys/netinet/if_ether.c 10 Feb 2025 15:35:01 -0000 @@ -337,7 +337,7 @@ arpresolve(struct ifnet *ifp, struct rte struct arpcom *ac = (struct arpcom *)ifp; struct llinfo_arp *la; struct sockaddr_dl *sdl; - struct rtentry *rt = NULL; + struct rtentry *rt; char addr[INET_ADDRSTRLEN]; time_t uptime; int refresh = 0, reject = 0; @@ -357,6 +357,7 @@ arpresolve(struct ifnet *ifp, struct rte if (ISSET(rt->rt_flags, RTF_REJECT) && (rt->rt_expire == 0 || rt->rt_expire > uptime)) { m_freem(m); + rtfree(rt); return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH); } @@ -404,6 +405,7 @@ arpresolve(struct ifnet *ifp, struct rte &satosin(dst)->sin_addr.s_addr, ac->ac_enaddr); } + rtfree(rt); return (0); } @@ -472,10 +474,12 @@ arpresolve(struct ifnet *ifp, struct rte if (refresh) arprequest(ifp, &satosin(rt->rt_ifa->ifa_addr)->sin_addr.s_addr, &satosin(dst)->sin_addr.s_addr, ac->ac_enaddr); + rtfree(rt); return (EAGAIN); bad: m_freem(m); + rtfree(rt); return (EINVAL); } Index: sys/netinet6/nd6.c =================================================================== RCS file: /mount/openbsd/cvs/src/sys/netinet6/nd6.c,v diff -u -p -u -p -r1.284 nd6.c --- sys/netinet6/nd6.c 31 Jan 2025 11:44:47 -0000 1.284 +++ sys/netinet6/nd6.c 10 Feb 2025 15:35:01 -0000 @@ -1288,6 +1288,7 @@ nd6_resolve(struct ifnet *ifp, struct rt if (ISSET(rt->rt_flags, RTF_REJECT) && (rt->rt_expire == 0 || rt->rt_expire > uptime)) { m_freem(m); + rtfree(rt); return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH); } @@ -1357,6 +1358,7 @@ nd6_resolve(struct ifnet *ifp, struct rt } bcopy(LLADDR(sdl), desten, sdl->sdl_alen); + rtfree(rt); return (0); } @@ -1394,10 +1396,12 @@ nd6_resolve(struct ifnet *ifp, struct rt if (solicit) nd6_ns_output(ifp, NULL, &satosin6(dst)->sin6_addr, &saddr6, 0); + rtfree(rt); return (EAGAIN); bad: m_freem(m); + rtfree(rt); return (EINVAL); }