Timers configured with rt_timer_add(9) are always run under splsoftnet() so no need to take it recursively.
ok? Index: netinet/ip_icmp.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_icmp.c,v retrieving revision 1.152 diff -u -p -r1.152 ip_icmp.c --- netinet/ip_icmp.c 22 Aug 2016 15:37:23 -0000 1.152 +++ netinet/ip_icmp.c 7 Nov 2016 09:23:47 -0000 @@ -1046,7 +1046,8 @@ void icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r) { struct ifnet *ifp; - int s; + + splsoftassert(IPL_SOFTNET); ifp = if_get(rt->rt_ifidx); if (ifp == NULL) @@ -1058,7 +1059,6 @@ icmp_mtudisc_timeout(struct rtentry *rt, sin = *satosin(rt_key(rt)); - s = splsoftnet(); rtdeletemsg(rt, ifp, r->rtt_tableid); /* Notify TCP layer of increased Path MTU estimate */ @@ -1066,7 +1066,6 @@ icmp_mtudisc_timeout(struct rtentry *rt, if (ctlfunc) (*ctlfunc)(PRC_MTUINC, sintosa(&sin), r->rtt_tableid, NULL); - splx(s); } else { if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) rt->rt_rmx.rmx_mtu = 0; @@ -1097,16 +1096,15 @@ void icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r) { struct ifnet *ifp; - int s; + + splsoftassert(IPL_SOFTNET); ifp = if_get(rt->rt_ifidx); if (ifp == NULL) return; if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { - s = splsoftnet(); rtdeletemsg(rt, ifp, r->rtt_tableid); - splx(s); } if_put(ifp); Index: netinet6/icmp6.c =================================================================== RCS file: /cvs/src/sys/netinet6/icmp6.c,v retrieving revision 1.190 diff -u -p -r1.190 icmp6.c --- netinet6/icmp6.c 24 Aug 2016 09:38:29 -0000 1.190 +++ netinet6/icmp6.c 7 Nov 2016 09:24:37 -0000 @@ -1947,16 +1947,15 @@ void icmp6_mtudisc_timeout(struct rtentry *rt, struct rttimer *r) { struct ifnet *ifp; - int s; + + splsoftassert(IPL_SOFTNET); ifp = if_get(rt->rt_ifidx); if (ifp == NULL) return; if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { - s = splsoftnet(); rtdeletemsg(rt, ifp, r->rtt_tableid); - splx(s); } else { if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) rt->rt_rmx.rmx_mtu = 0; @@ -1969,16 +1968,15 @@ void icmp6_redirect_timeout(struct rtentry *rt, struct rttimer *r) { struct ifnet *ifp; - int s; + + splsoftassert(IPL_SOFTNET); ifp = if_get(rt->rt_ifidx); if (ifp == NULL) return; if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { - s = splsoftnet(); rtdeletemsg(rt, ifp, r->rtt_tableid); - splx(s); } if_put(ifp); Index: net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.333 diff -u -p -r1.333 route.c --- net/route.c 6 Oct 2016 19:09:08 -0000 1.333 +++ net/route.c 7 Nov 2016 09:22:11 -0000 @@ -1498,6 +1498,8 @@ rt_timer_queue_destroy(struct rttimer_qu { struct rttimer *r; + splsoftassert(IPL_SOFTNET); + while ((r = TAILQ_FIRST(&rtq->rtq_head)) != NULL) { LIST_REMOVE(r, rtt_link); TAILQ_REMOVE(&rtq->rtq_head, r, rtt_next);