 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6.c,v 1.256.2.2 2019/08/26 13:42:36 martin Exp $	*/
+/*	$NetBSD: nd6.c,v 1.256.2.3 2019/09/01 11:00:31 martin Exp $	*/
 /*	$KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.256.2.2 2019/08/26 13:42:36 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.256.2.3 2019/09/01 11:00:31 martin Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_net_mpsafe.h"
 #endif
 #include "bridge.h"
 #include "carp.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
 #include <sys/kmem.h>
 #include <sys/mbuf.h>
 @@ -1179,129 +1179,116 @@ nd6_is_addr_neighbor(const struct sockad
 	return 0;
+}
 /*
  * Free an nd6 llinfo entry.
  * Since the function would cause significant changes in the kernel, DO NOT
  * make it global, unless you have a strong reason for the change, and are sure
  * that the change is safe.
  */
 static void
 nd6_free(struct llentry *ln, int gc)
+{
 	struct nd_defrouter *dr;
 	struct ifnet *ifp;
 	struct in6_addr *in6;
 	struct sockaddr_in6 sin6;
 	KASSERT(ln != NULL);
 	LLE_WLOCK_ASSERT(ln);
 	ifp = ln->lle_tbl->llt_ifp;
 	in6 = &ln->r_l3addr.addr6;
 	/*
 	 * we used to have pfctlinput(PRC_HOSTDEAD) here.
 	 * even though it is not harmful, it was not really necessary.
 	 */
-	if (!ip6_forwarding) {
+	if (!ip6_forwarding && ln->ln_router) {
-		ND6_WLOCK();
+		if (ln->ln_state == ND6_LLINFO_STALE && gc) {
 		dr = nd6_defrouter_lookup(in6, ifp);
 		if (dr != NULL && dr->expire &&
 		    ln->ln_state == ND6_LLINFO_STALE && gc) {
 			/*
 			 * If the reason for the deletion is just garbage
-			 * collection, and the neighbor is an active default
+			 * collection, and the neighbor is an active
 			 * router, do not delete it.  Instead, reset the GC
 			 * timer using the router's lifetime.
-			 * Simply deleting the entry would affect default
+			 * Simply deleting the entry may affect default
 			 * router selection, which is not necessarily a good
 			 * thing, especially when we're using router preference
 			 * values.
 			 * XXX: the check for ln_state would be redundant,
 			 *      but we intentionally keep it just in case.
 			 */
-			if (dr->expire > time_uptime)
+			if (ln->ln_expire > time_uptime)
 				nd6_llinfo_settimer(ln,
-				    (dr->expire - time_uptime) * hz);
+				    (ln->ln_expire - time_uptime) * hz);
 			else
 				nd6_llinfo_settimer(ln, nd6_gctimer * hz);
 			ND6_UNLOCK();
 			LLE_WUNLOCK(ln);
 			return;
+		}
-		if (ln->ln_router || dr) {
+		ND6_WLOCK();
 			/*
 			 * We need to unlock to avoid a LOR with nd6_rt_flush()
 			 * with the rnh and for the calls to
 			 * nd6_pfxlist_onlink_check() and nd6_defrouter_select() in the
 			 * block further down for calls into nd6_lookup().
 			 * We still hold a ref.
 			 */
 			LLE_WUNLOCK(ln);
 			/*
 			 * nd6_rt_flush must be called whether or not the neighbor
 			 * is in the Default Router List.
 			 * See a corresponding comment in nd6_na_input().
 			 */
 			nd6_rt_flush(in6, ifp);
-		if (dr) {
+		/*
-			/*
+		 * We need to unlock to avoid a LOR with nd6_rt_flush()
-			 * Unreachablity of a router might affect the default
+		 * with the rnh and for the calls to
-			 * router selection and on-link detection of advertised
+		 * nd6_pfxlist_onlink_check() and nd6_defrouter_select() in the
-			 * prefixes.
+		 * block further down for calls into nd6_lookup().
-			 */
+		 * We still hold a ref.
+		 *
 		 * Temporarily fake the state to choose a new default
 		 * router and to perform on-link determination of
 		 * prefixes correctly.
 		 * Below the state will be set correctly,
 		 * or the entry itself will be deleted.
 		 */
 		ln->ln_state = ND6_LLINFO_INCOMPLETE;
 		LLE_WUNLOCK(ln);
-			/*
+		/*
-			 * Temporarily fake the state to choose a new default
+		 * nd6_rt_flush must be called whether or not the neighbor
-			 * router and to perform on-link determination of
+		 * is in the Default Router List.
-			 * prefixes correctly.
+		 * See a corresponding comment in nd6_na_input().
-			 * Below the state will be set correctly,
+		 */
-			 * or the entry itself will be deleted.
+		nd6_rt_flush(in6, ifp);
 			 */
 			ln->ln_state = ND6_LLINFO_INCOMPLETE;
-			/*
+		/*
-			 * Since nd6_defrouter_select() does not affect the
+		 * Unreachablity of a router might affect the default
-			 * on-link determination and MIP6 needs the check
+		 * router selection and on-link detection of advertised
-			 * before the default router selection, we perform
+		 * prefixes.
 			 * the check now.
-			 */
+		 * Since nd6_defrouter_select() does not affect the
-			nd6_pfxlist_onlink_check();
+		 * on-link determination and MIP6 needs the check
 		 * before the default router selection, we perform
 		 * the check now.
 		 */
 		nd6_pfxlist_onlink_check();
-			/*
+		/*
-			 * refresh default router list
+		 * refresh default router list
-			 */
+		 */
-			nd6_defrouter_select();
+		nd6_defrouter_select();
 #ifdef __FreeBSD__
 		/*
 		 * If this entry was added by an on-link redirect, remove the
 		 * corresponding host route.
 		 */
 		if (ln->la_flags & LLE_REDIRECT)
 			nd6_free_redirect(ln);
 #endif
 		ND6_UNLOCK();
-		if (ln->ln_router || dr)
+		ND6_UNLOCK();
-			LLE_WLOCK(ln);
+		LLE_WLOCK(ln);
+	}
 	sockaddr_in6_init(&sin6, in6, 0, 0, 0);
 	rt_clonedmsg(RTM_DELETE, sin6tosa(&sin6),
 	    (const uint8_t *)&ln->ll_addr, ifp);
 	/*
 	 * Save to unlock. We still hold an extra reference and will not
 	 * free(9) in llentry_free() if someone else holds one as well.
 	 */
 	LLE_WUNLOCK(ln);
 	IF_AFDATA_LOCK(ifp);
 	LLE_WLOCK(ln);