[src/trunk]: src/sys/net Fix race condition on la_rt between lltable_free and...

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3ce58f2f8cf7
branches:  trunk
changeset: 340499:3ce58f2f8cf7
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Wed Sep 09 01:26:50 2015 +0000

description:
Fix race condition on la_rt between lltable_free and other places touching la_rt

We have to touch la_rt always with holding softnet_lock. And we have to
use callout_halt with softnet_lock instead of callout_stop for
la_timer (arptimer) because arptimer holds softnet_lock inside it.

This fix may solve a kernel panic christos@ encountered.

diffstat:

 sys/net/if_llatbl.c |  7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diffs (36 lines):

diff -r c697ed6b24d1 -r 3ce58f2f8cf7 sys/net/if_llatbl.c
--- a/sys/net/if_llatbl.c       Wed Sep 09 01:24:01 2015 +0000
+++ b/sys/net/if_llatbl.c       Wed Sep 09 01:26:50 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_llatbl.c,v 1.3 2015/08/31 12:57:45 pooka Exp $      */
+/*     $NetBSD: if_llatbl.c,v 1.4 2015/09/09 01:26:50 ozaki-r Exp $    */
 /*
  * Copyright (c) 2004 Luigi Rizzo, Alessandro Cerri. All rights reserved.
  * Copyright (c) 2004-2008 Qing Li. All rights reserved.
@@ -42,6 +42,7 @@
 #include <sys/syslog.h>
 #include <sys/sysctl.h>
 #include <sys/socket.h>
+#include <sys/socketvar.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
@@ -370,8 +371,9 @@
        llentries_unlink(llt, &dchain);
        IF_AFDATA_WUNLOCK(llt->llt_ifp);
 
+       mutex_enter(softnet_lock);
        LIST_FOREACH_SAFE(lle, &dchain, lle_chain, next) {
-               if (callout_stop(&lle->la_timer))
+               if (callout_halt(&lle->la_timer, softnet_lock))
                        LLE_REMREF(lle);
 #if defined(__NetBSD__)
                /* XXX should have callback? */
@@ -380,6 +382,7 @@
 #endif
                llentry_free(lle);
        }
+       mutex_exit(softnet_lock);
 
        llt->llt_free_tbl(llt);
 }