https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225927
--- Comment #4 from Andrey V. Elsukov <a...@freebsd.org> ---
(In reply to Hans Petter Selasky from comment #3)
> Can you try the patch in D4605 ?
This problem is not easy to trigger and I'm not sure that the patch solves it.
I think how it happens:
on ifnet departure in6_domifdetach() is called, then lltable_free() unlinks
lltable and acquires LLE_WLOCK for each llentry. While we are acquiring all
these locks it is possible, that callout for some entry has been started and
blocked on the LLE_WLOCK() since lock is held by lltable_free(). Then
llentry_free() releases LLE_WLOCK(), and nd6_llinfo_timer() acquires it. Now we
have invalid ifp pointer, it is strange enough that it is NULL...
About your patch, it seems the code:
if (callout_stop(&lle->lle_timer) > 0)
LLE_REMREF(lle);
can be placed in the llentry_free() only once, and also removed from
lltable_free(). But it doesn't protect from described scenario. I think we need
somehow handle the case when nd6_llinfo_timer() is already active, but it
hasn't obtained lock yet.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-net@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
