6951991 assertion failed: IRE_IS_CONDEMNED(child), file: ../../common/inet/ip/ip_ire.c, line: 3559

1 files changed, 10 insertions, 5 deletions

diff --git a/usr/src/uts/common/inet/ip/ip6_ire.c b/usr/src/uts/common/inet/ip/ip6_ire.c
index e22b5d17d4..4828b831fd 100644
--- a/usr/src/uts/common/inet/ip/ip6_ire.c
+++ b/usr/src/uts/common/inet/ip/ip6_ire.c
@@ -19,10 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-/*
+ * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 1990 Mentat Inc.
  */
 
@@ -416,11 +413,19 @@ ire_add_v6(ire_t *ire)
 			 * after adding, we return a held ire. This will
 			 * avoid a lookup in the caller again. If the callers
 			 * don't want to use it, they need to do a REFRELE.
+			 *
+			 * We only allow exactly one IRE_IF_CLONE for any dst,
+			 * so, if the is an IF_CLONE, return the ire without
+			 * an identical_ref, but with an ire_ref held.
 			 */
+			if (ire->ire_type != IRE_IF_CLONE) {
+				atomic_add_32(&ire1->ire_identical_ref, 1);
+				DTRACE_PROBE2(ire__add__exist, ire_t *, ire1,
+				    ire_t *, ire);
+			}
 			ip1dbg(("found dup ire existing %p new %p",
 			    (void *)ire1, (void *)ire));
 			ire_refhold(ire1);
-			atomic_add_32(&ire1->ire_identical_ref, 1);
 			ire_atomic_end(irb_ptr, ire);
 			ire_delete(ire);
 			return (ire1);