[src/trunk]: src/sys/netinet6 Make a refcount decrement and a removal from a ...

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/53096857192b
branches:  trunk
changeset: 319416:53096857192b
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Tue May 29 04:37:58 2018 +0000

description:
Make a refcount decrement and a removal from a list of an item atomic

in6m_refcount of an in6m can be incremented if the in6m is on the list
(if_multiaddrs) in in6_addmulti or mld_input.  So we must avoid such an
increment when we try to destroy an in6m.  To this end we must make
an in6m_refcount decrement and a removal of an in6m from if_multiaddrs
atomic.

diffstat:

 sys/netinet6/mld6.c |  17 ++++++++++-------
 1 files changed, 10 insertions(+), 7 deletions(-)

diffs (44 lines):

diff -r 417a8e880977 -r 53096857192b sys/netinet6/mld6.c
--- a/sys/netinet6/mld6.c       Tue May 29 04:37:16 2018 +0000
+++ b/sys/netinet6/mld6.c       Tue May 29 04:37:58 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: mld6.c,v 1.95 2018/05/29 04:36:47 ozaki-r Exp $        */
+/*     $NetBSD: mld6.c,v 1.96 2018/05/29 04:37:58 ozaki-r Exp $        */
 /*     $KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $   */
 
 /*
@@ -102,7 +102,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.95 2018/05/29 04:36:47 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.96 2018/05/29 04:37:58 ozaki-r Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -777,17 +777,20 @@
        KASSERT(in6m->in6m_refcount == 0);
 
        /*
+        * Unlink from list.  This must be done before mld_stop_listening
+        * because it releases in6_multilock and that allows someone to
+        * look up the removing in6m from the list and add a reference to the
+        * entry unexpectedly.
+        */
+       LIST_REMOVE(in6m, in6m_entry);
+
+       /*
         * No remaining claims to this record; let MLD6 know
         * that we are leaving the multicast group.
         */
        mld_stop_listening(in6m);
 
        /*
-        * Unlink from list.
-        */
-       LIST_REMOVE(in6m, in6m_entry);
-
-       /*
         * Delete all references of this multicasting group from
         * the membership arrays
         */