[Midnightbsd-cvs] src [9014] trunk/sys: The LLE_LINKED flag should be tested prior to entering llentry_free

[laffer1 at midnightbsd.org]

Revision: 9014
          http://svnweb.midnightbsd.org/src/?rev=9014
Author:   laffer1
Date:     2016-09-29 21:52:13 -0400 (Thu, 29 Sep 2016)
Log Message:
-----------
The LLE_LINKED flag should be tested prior to entering llentry_free

Modified Paths:
--------------
    trunk/sys/net/if_llatbl.c
    trunk/sys/netinet/if_ether.c
    trunk/sys/netinet6/nd6.c

Modified: trunk/sys/net/if_llatbl.c
===================================================================
--- trunk/sys/net/if_llatbl.c	2016-09-30 01:51:27 UTC (rev 9013)
+++ trunk/sys/net/if_llatbl.c	2016-09-30 01:52:13 UTC (rev 9014)
@@ -112,12 +112,6 @@
 	IF_AFDATA_WLOCK_ASSERT(lle->lle_tbl->llt_ifp);
 	LLE_WLOCK_ASSERT(lle);
 
-	/* XXX: guard against race with other llentry_free(). */
-	if (!(lle->la_flags & LLE_LINKED)) {
-		LLE_FREE_LOCKED(lle);
-		return (0);
-	}
-
 	LIST_REMOVE(lle, lle_next);
 	lle->la_flags &= ~(LLE_VALID | LLE_LINKED);
 

Modified: trunk/sys/netinet/if_ether.c
===================================================================
--- trunk/sys/netinet/if_ether.c	2016-09-30 01:51:27 UTC (rev 9013)
+++ trunk/sys/netinet/if_ether.c	2016-09-30 01:52:13 UTC (rev 9014)
@@ -169,7 +169,6 @@
 {
 	struct llentry *lle = (struct llentry *)arg;
 	struct ifnet *ifp;
-	size_t pkts_dropped;
 
 	if (lle->la_flags & LLE_STATIC) {
 		LLE_WUNLOCK(lle);
@@ -196,11 +195,20 @@
 	IF_AFDATA_LOCK(ifp);
 	LLE_WLOCK(lle);
 
-	LLE_REMREF(lle);
-	pkts_dropped = llentry_free(lle);
+	/* Guard against race with other llentry_free(). */
+	if (lle->la_flags & LLE_LINKED) {
+		size_t pkts_dropped;
+
+		LLE_REMREF(lle);
+		pkts_dropped = llentry_free(lle);
+		ARPSTAT_ADD(dropped, pkts_dropped);
+	} else
+		LLE_FREE_LOCKED(lle);
+
 	IF_AFDATA_UNLOCK(ifp);
-	ARPSTAT_ADD(dropped, pkts_dropped);
+
 	ARPSTAT_INC(timeouts);
+
 	CURVNET_RESTORE();
 }
 

Modified: trunk/sys/netinet6/nd6.c
===================================================================
--- trunk/sys/netinet6/nd6.c	2016-09-30 01:51:27 UTC (rev 9013)
+++ trunk/sys/netinet6/nd6.c	2016-09-30 01:52:13 UTC (rev 9014)
@@ -1114,8 +1114,14 @@
 	LLE_WUNLOCK(ln);
 	IF_AFDATA_LOCK(ifp);
 	LLE_WLOCK(ln);
-	LLE_REMREF(ln);
-	llentry_free(ln);
+
+	/* Guard against race with other llentry_free(). */
+	if (ln->la_flags & LLE_LINKED) {
+		LLE_REMREF(ln);
+		llentry_free(ln);
+	} else
+		LLE_FREE_LOCKED(ln);
+
 	IF_AFDATA_UNLOCK(ifp);
 
 	return (next);