[src/trunk]: src/sys/netinet6 Fix a deadlock on callout_halt of nd6_dad_timer

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9e372eef65d8
branches:  trunk
changeset: 828922:9e372eef65d8
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Wed Jan 10 07:11:38 2018 +0000

description:
Fix a deadlock on callout_halt of nd6_dad_timer

We must not call callout_halt of nd6_dad_timer with holding nd6_dad_lock because
the lock is taken in nd6_dad_timer. Once softnet_lock goes away, we can pass the
lock to callout_halt, but for now we cannot.

diffstat:

 sys/netinet6/nd6_nbr.c |  10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diffs (38 lines):

diff -r 6a65998438b5 -r 9e372eef65d8 sys/netinet6/nd6_nbr.c
--- a/sys/netinet6/nd6_nbr.c    Wed Jan 10 07:08:35 2018 +0000
+++ b/sys/netinet6/nd6_nbr.c    Wed Jan 10 07:11:38 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nd6_nbr.c,v 1.140 2017/12/26 02:26:45 ozaki-r Exp $    */
+/*     $NetBSD: nd6_nbr.c,v 1.141 2018/01/10 07:11:38 ozaki-r Exp $    */
 /*     $KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $        */
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.140 2017/12/26 02:26:45 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.141 2018/01/10 07:11:38 ozaki-r Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1356,9 +1356,6 @@
        ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
        ia->ia6_flags |= IN6_IFF_DUPLICATED;
 
-       /* We are done with DAD, with duplicated address found. (failure) */
-       nd6_dad_stoptimer(dp);
-
        log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
            if_name(ifp), IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr));
        log(LOG_ERR, "%s: manual intervention required\n",
@@ -1404,6 +1401,9 @@
        TAILQ_REMOVE(&dadq, dp, dad_list);
        mutex_exit(&nd6_dad_lock);
 
+       /* We are done with DAD, with duplicated address found. (failure) */
+       nd6_dad_stoptimer(dp);
+
        kmem_intr_free(dp, sizeof(*dp));
        ifafree(ifa);
 }