Do not flush RTF_CLONED children when adding a new route.

New RTF_CLONING routes don't have children, but the kernel might end up
removing routes from a compatible route.  This bug has been introduced
with the support for multiple RTF_CLONING routes.

Also make sure to release possible RTF_CACHED route *before* flushing
RTF_CLONED children when deleting a route.

KASSERT() reported by akfaew, sthen@ and martijn@

ok benno@

1 files changed, 6 insertions, 10 deletions

diff --git a/sys/net/route.c b/sys/net/route.c
index 344f5af66e8..e02600bd040 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.318 2016/08/30 23:29:39 dlg Exp $	*/
+/*	$OpenBSD: route.c,v 1.319 2016/08/31 08:13:17 mpi Exp $	*/
 /*	$NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $	*/
 
 /*
@@ -928,12 +928,13 @@ rtrequest_delete(struct rt_addrinfo *info, u_int8_t prio, struct ifnet *ifp,
 		return (ESRCH);
 	}
 
-	/* clean up any cloned children */
-	if ((rt->rt_flags & RTF_CLONING) != 0)
-		rtflushclone(tableid, rt);
-
+	/* Release next hop cache before flushing cloned entries. */
 	rt_putgwroute(rt);
 
+	/* Clean up any cloned children. */
+	if (ISSET(rt->rt_flags, RTF_CLONING))
+		rtflushclone(tableid, rt);
+
 	rtfree(rt->rt_parent);
 	rt->rt_parent = NULL;
 
@@ -1179,11 +1180,6 @@ rtrequest(int req, struct rt_addrinfo *info, u_int8_t prio,
 		}
 		ifp->if_rtrequest(ifp, req, rt);
 
-		if ((rt->rt_flags & RTF_CLONING) != 0) {
-			/* clean up any cloned children */
-			rtflushclone(tableid, rt);
-		}
-
 		if_group_routechange(info->rti_info[RTAX_DST],
 			info->rti_info[RTAX_NETMASK]);