> > On Fri, Mar 30, 2012 at 12:28 AM, Li, Qing <qing...@bluecoat.com> wrote: > >> * In a way this is a good thing as in6_lltable_prefix_free() is > >> guaranteed to crash your kernel in two different ways, and that's > not > >> counting the race conditions that it's subject to. > >> > > > > Could you please elaborate with some details on the two > different > > ways in6_lltable_prefix_free() crashes the kernel > definitively ? > > First, it calls callout_drain on lle->le_timer, but that is never > initialized for a v6 llentry. Second, it never stops the ln_timer_ch > callout before it frees the llentry. Third, it modifies the lltable > without holding IF_AFDATA_LOCK(in.c has the third problem: see the > -net discussion about kern/165863).
1. The reference to &lle->la_timer instead of ln_timer_ch is fine because lle_timer is defined as a union. 2. The manpage of "callout_drain()" reads "The function callout_drain() is identical to callout_stop() except that it will wait for the callout to be completed if it is already in progress." 3. wrt IF_AFDATA_LOCK() I will check again. --Qing _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
