Locking question

[Mark Keaton <mkeaton%bbn.com@localhost>]

I am trying to understand the locking strategy used in the following 
functions on NetBSD 6:

  ip_input()
  ip_output()
  ip6_input()
  ip6_output()
  ip6_forward()

There are several cases where these functions are called with the 
"softnet_lock" mutex locked, and I assumed that this would always be true.

However, I added a KASSERT(mutex_owned(softnet_lock)) call to these 
functions, ran a test, and found that there is at least one case where 
this assertion fails.  Here is the call chain that caused the failure:

  ip6_output()
  mld_sendpkt()
  mld_start_listening()
  in6_addmulti()
  in6_joingroup()
  in6_update_ifa1()
  in6_update_ifa()
  in6_control1()
  in6_control()
  udp6_usrreq_wrapper()
  compat_ifioctl()
  ifioctl()
  soo_ioctl()
  sys_ioctl()
  sy_call()
  syscall()

So, I am wondering if anyone knows if this is a bug in the kernel (i.e., 
"softnet_lock" should have been locked before calling ip6_output())? 
Or, am I not understanding the real locking strategy used by these 
functions?

Any help is appreciated.

-Mark

---
Mark Keaton
mkeaton%bbn.com@localhost