Re: kern/49462: if_slowtimo callout mangled?

[David Laight <david%l8s.co.uk@localhost>]

The following reply was made to PR kern/49462; it has been noted by GNATS.

From: David Laight <david%l8s.co.uk@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/49462: if_slowtimo callout mangled?
Date: Wed, 17 Dec 2014 22:16:36 +0000

 On Thu, Dec 11, 2014 at 02:55:01PM +0000, Masao Uebayashi wrote:
 > The following reply was made to PR kern/49462; it has been noted by GNATS.
 > 
 >  I would do this, to close possible race window, by dereference ifp->if_slowtimo
 >  only once:
 >  
 >  void
 >  if_slowtimo(void *arg)
 >  {
 >  	void (*slowtimo)(void *);
 >  	int s;
 >  
 >  	slowtimo = ifp->if_slowtimo;
 >  	if (slowtimo == NULL)
 >  		return;
 >  	s = splnet();
 >  	if (ifp->if_timer != 0 && --ifp->if_timer == 0)
 >  		(*slowtimo)(ifp);
 >  	splx(s);
 >  	callout_schedule(ifp->if_slowtimo_ch, hz / IFNET_SLOWHZ);
 >  }
 
 That still looks racy to me.
 I'd have expected that if_slowtimo would need to read inside splnet().
 Otherwuse reading it twice wouldn't matter.
 It does rather depend on what else might clear it.
 
 	David
 
 -- 
 David Laight: david%l8s.co.uk@localhost