kern/88725: /usr/sbin/ppp panic with 2005.10.21 netinet6 changes

[John Baldwin]

The following reply was made to PR kern/88725; it has been noted by GNATS.

From: John Baldwin <jhb at freebsd.org>
To: freebsd-current at freebsd.org
Cc: SUZUKI Shinsuke <suz at freebsd.org>, snezhko at indorsoft.ru,
        max at love2party.net, bug-followup at freebsd.org
Subject: Re: kern/88725: /usr/sbin/ppp panic with 2005.10.21 netinet6 changes
Date: Thu, 10 Nov 2005 11:40:13 -0500

 On Thursday 10 November 2005 10:40 am, SUZUKI Shinsuke wrote:
 > >>>>> On Thu, 10 Nov 2005 16:54:34 +0600
 > >>>>> snezhko at indorsoft.ru(Victor Snezhko)  said:
 > >
 > > Mark Tinguely has found the offending timer.
 > > The following patch fixes the problem for me:
 >
 > Thanks.  sounds right for me.
 > So please commit it if when you've finished the test with fresh -current.
 
 As a general rule you should be using callout_drain() before freeing a callout 
 to handle the race condition where the callout is running on another CPU (so 
 callout_stop can't stop it) while you are freeing it.  Note that you can not 
 use callout_drain() if you are holding any locks, though.  In those cases you 
 will need to defer the callout_drain() and free() until you have dropped the 
 locks.  Here's one example fix:
 
 Index: nd6.c
 ===================================================================
 RCS file: /usr/cvs/src/sys/netinet6/nd6.c,v
 retrieving revision 1.62
 diff -u -r1.62 nd6.c
 --- nd6.c       22 Oct 2005 05:07:16 -0000      1.62
 +++ nd6.c       3 Nov 2005 19:56:42 -0000
 @@ -398,7 +398,7 @@
         if (tick < 0) {
                 ln->ln_expire = 0;
                 ln->ln_ntick = 0;
 -               callout_stop(&ln->ln_timer_ch);
 +               callout_drain(&ln->ln_timer_ch);
         } else {
                 ln->ln_expire = time_second + tick / hz;
                 if (tick > INT_MAX) {
  
 -- 
 John Baldwin <jhb at FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
 "Power Users Use the Power to Serve"  =  http://www.FreeBSD.org