Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
MIME-Version: 1.0
Date: Sat, 24 Feb 2018 07:53:15 +0000
From: "Ryota Ozaki" <ozaki-r@netbsd.org>
Subject: CVS commit: src/sys
To: source-changes@NetBSD.org
Message-Id: <20180224075315.BFDA7FB40@cvs.NetBSD.org>
Sender: source-changes-owner@NetBSD.org
Precedence: bulk
Reply-To: source-changes-d@NetBSD.org
Mail-Reply-To: "Ryota Ozaki" <ozaki-r@netbsd.org>
Mail-Followup-To: source-changes-d@NetBSD.org

Module Name:	src
Committed By:	ozaki-r
Date:		Sat Feb 24 07:53:15 UTC 2018

Modified Files:
	src/sys/netinet: if_arp.c
	src/sys/netinet6: nd6_nbr.c

Log Message:
Avoid a race condition of DAD timer destructions

When we see dp->dad_ifa == NULL, it means that the ifa is being deleted and also
the callout is scheduled again by someone.  We shouldn't rely on a result of
callout_pending to know if the callout is scheduled because it returns false if
the subsequent callout handler is already on the fly.

We have to always delegate the destruction of dp to the subsequent handler
unconditionally if dp->dad_ifa == NULL. Otherwise, the first handler destroys
the dp and the second handler tries to handle destroyed dp.


To generate a diff of this commit:
cvs rdiff -u -r1.266 -r1.267 src/sys/netinet/if_arp.c
cvs rdiff -u -r1.147 -r1.148 src/sys/netinet6/nd6_nbr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.