route leak nd6 detach

[Alexander Bluhm]

Hi,

While testing my ART reference couting fix, I discovered a rtentry
leak that is triggered by regress/sbin/route and detected with
btrace(8) refcnt.

The reference returned by rtalloc() must be freed with rtfree() in
all cases.

ok?

bluhm

Index: netinet6/in6_ifattach.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/in6_ifattach.c,v
retrieving revision 1.121
diff -u -p -r1.121 in6_ifattach.c
--- netinet6/in6_ifattach.c     15 Nov 2022 18:42:46 -0000      1.121
+++ netinet6/in6_ifattach.c     9 Jul 2023 11:20:39 -0000
@@ -440,10 +440,9 @@ in6_ifdetach(struct ifnet *ifp)
        sin6.sin6_addr = in6addr_intfacelocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-       if (rt && rt->rt_ifidx == ifp->if_index) {
+       if (rt && rt->rt_ifidx == ifp->if_index)
                rtdeletemsg(rt, ifp, ifp->if_rdomain);
-               rtfree(rt);
-       }
+       rtfree(rt);
 
        /* remove route to link-local allnodes multicast (ff02::1) */
        bzero(&sin6, sizeof(sin6));
@@ -452,10 +451,9 @@ in6_ifdetach(struct ifnet *ifp)
        sin6.sin6_addr = in6addr_linklocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        rt = rtalloc(sin6tosa(&sin6), 0, ifp->if_rdomain);
-       if (rt && rt->rt_ifidx == ifp->if_index) {
+       if (rt && rt->rt_ifidx == ifp->if_index)
                rtdeletemsg(rt, ifp, ifp->if_rdomain);
-               rtfree(rt);
-       }
+       rtfree(rt);
 
        if (ifp->if_xflags & (IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP))
                ifp->if_xflags &= ~(IFXF_AUTOCONF6 | IFXF_AUTOCONF6TEMP);