From ba00f0096dc2f3d598305739e7b65db8c0049d8c Mon Sep 17 00:00:00 2001
From: Sam Leffler <sam@FreeBSD.org>
Date: Tue, 14 Oct 2003 18:49:08 +0000
Subject: [PATCH] MFp4: correct locking issues in nd6_lookup

Supported by:	FreeBSD Foundation
---
 sys/netinet6/nd6.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index b876f8a9598a..be14f33fb026 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -811,7 +811,6 @@ nd6_lookup(addr6, create, ifp)
 			RTFREE_LOCKED(rt);
 			rt = 0;
 		}
-		RT_UNLOCK(rt);
 	}
 	if (!rt) {
 		if (create && ifp) {
@@ -846,6 +845,7 @@ nd6_lookup(addr6, create, ifp)
 			}
 			if (rt == NULL)
 				return (NULL);
+			RT_LOCK(rt);
 			if (rt->rt_llinfo) {
 				struct llinfo_nd6 *ln =
 				    (struct llinfo_nd6 *)rt->rt_llinfo;
@@ -854,6 +854,7 @@ nd6_lookup(addr6, create, ifp)
 		} else
 			return (NULL);
 	}
+	RT_LOCK_ASSERT(rt);
 	rt->rt_refcnt--;
 	/*
 	 * Validation for the entry.
@@ -877,8 +878,10 @@ nd6_lookup(addr6, create, ifp)
 			    ifp ? if_name(ifp) : "unspec");
 			/* xxx more logs... kazu */
 		}
+		RT_UNLOCK(rt);
 		return (NULL);
 	}
+	RT_UNLOCK(rt);		/* XXX not ready to return rt locked */
 	return (rt);
 }