Module Name: src
Committed By: ozaki-r
Date: Tue May 29 04:37:58 UTC 2018
Modified Files:
src/sys/netinet6: mld6.c
Log Message:
Make a refcount decrement and a removal from a list of an item atomic
in6m_refcount of an in6m can be incremented if the in6m is on the list
(if_multiaddrs) in in6_addmulti or mld_input. So we must avoid such an
increment when we try to destroy an in6m. To this end we must make
an in6m_refcount decrement and a removal of an in6m from if_multiaddrs
atomic.
To generate a diff of this commit:
cvs rdiff -u -r1.95 -r1.96 src/sys/netinet6/mld6.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netinet6/mld6.c
diff -u src/sys/netinet6/mld6.c:1.95 src/sys/netinet6/mld6.c:1.96
--- src/sys/netinet6/mld6.c:1.95 Tue May 29 04:36:47 2018
+++ src/sys/netinet6/mld6.c Tue May 29 04:37:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: mld6.c,v 1.95 2018/05/29 04:36:47 ozaki-r Exp $ */
+/* $NetBSD: mld6.c,v 1.96 2018/05/29 04:37:58 ozaki-r Exp $ */
/* $KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $ */
/*
@@ -102,7 +102,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.95 2018/05/29 04:36:47 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.96 2018/05/29 04:37:58 ozaki-r Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -777,15 +777,18 @@ in6m_destroy(struct in6_multi *in6m)
KASSERT(in6m->in6m_refcount == 0);
/*
- * No remaining claims to this record; let MLD6 know
- * that we are leaving the multicast group.
+ * Unlink from list. This must be done before mld_stop_listening
+ * because it releases in6_multilock and that allows someone to
+ * look up the removing in6m from the list and add a reference to the
+ * entry unexpectedly.
*/
- mld_stop_listening(in6m);
+ LIST_REMOVE(in6m, in6m_entry);
/*
- * Unlink from list.
+ * No remaining claims to this record; let MLD6 know
+ * that we are leaving the multicast group.
*/
- LIST_REMOVE(in6m, in6m_entry);
+ mld_stop_listening(in6m);
/*
* Delete all references of this multicasting group from
