svn commit: r199567 - stable/8/sys/netinet6

[Hajimu UMEMOTO]

Author: ume
Date: Fri Nov 20 06:54:47 2009
New Revision: 199567
URL: http://svn.freebsd.org/changeset/base/199567

Log:
  MFC r199225:
  - We are not guaranteed that we're not dropping a reference that
    we did not add.  Call LLE_REMREF() only when callout_stop()
    actually canceled a pending callout.
  - callout_reset() may cancel a pending callout.  When
    callout_reset() canceled a pending callout, call LLE_REMREF()
    to drop a reference for the canceled callout.

Modified:
  stable/8/sys/netinet6/nd6.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/arm/   (props changed)
  stable/8/sys/boot/   (props changed)
  stable/8/sys/bsm/   (props changed)
  stable/8/sys/cddl/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/compat/   (props changed)
  stable/8/sys/contrib/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/crypto/   (props changed)
  stable/8/sys/ddb/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)
  stable/8/sys/fs/   (props changed)
  stable/8/sys/gdb/   (props changed)
  stable/8/sys/geom/   (props changed)
  stable/8/sys/gnu/   (props changed)
  stable/8/sys/i386/acpica/   (props changed)
  stable/8/sys/i386/bios/   (props changed)
  stable/8/sys/i386/compile/   (props changed)
  stable/8/sys/i386/cpufreq/   (props changed)
  stable/8/sys/i386/i386/   (props changed)
  stable/8/sys/i386/ibcs2/   (props changed)
  stable/8/sys/i386/include/   (props changed)
  stable/8/sys/i386/isa/   (props changed)
  stable/8/sys/i386/linux/   (props changed)
  stable/8/sys/i386/pci/   (props changed)
  stable/8/sys/i386/svr4/   (props changed)
  stable/8/sys/i386/xbox/   (props changed)
  stable/8/sys/i386/xen/   (props changed)
  stable/8/sys/ia64/   (props changed)
  stable/8/sys/isa/   (props changed)
  stable/8/sys/kern/   (props changed)
  stable/8/sys/kgssapi/   (props changed)
  stable/8/sys/libkern/   (props changed)
  stable/8/sys/mips/   (props changed)
  stable/8/sys/modules/   (props changed)
  stable/8/sys/net80211/   (props changed)
  stable/8/sys/netatalk/   (props changed)
  stable/8/sys/netgraph/   (props changed)
  stable/8/sys/netinet/   (props changed)
  stable/8/sys/netipsec/   (props changed)
  stable/8/sys/netipx/   (props changed)
  stable/8/sys/netnatm/   (props changed)
  stable/8/sys/netncp/   (props changed)
  stable/8/sys/netsmb/   (props changed)
  stable/8/sys/nfs/   (props changed)
  stable/8/sys/nfsclient/   (props changed)
  stable/8/sys/nfsserver/   (props changed)
  stable/8/sys/nlm/   (props changed)
  stable/8/sys/opencrypto/   (props changed)
  stable/8/sys/pc98/   (props changed)
  stable/8/sys/pci/   (props changed)
  stable/8/sys/powerpc/   (props changed)
  stable/8/sys/rpc/   (props changed)
  stable/8/sys/security/   (props changed)
  stable/8/sys/sparc64/   (props changed)
  stable/8/sys/sun4v/   (props changed)
  stable/8/sys/sys/   (props changed)
  stable/8/sys/tools/   (props changed)
  stable/8/sys/ufs/   (props changed)
  stable/8/sys/vm/   (props changed)
  stable/8/sys/xdr/   (props changed)
  stable/8/sys/xen/   (props changed)

Modified: stable/8/sys/netinet6/nd6.c
==============================================================================
--- stable/8/sys/netinet6/nd6.c	Fri Nov 20 03:14:54 2009	(r199566)
+++ stable/8/sys/netinet6/nd6.c	Fri Nov 20 06:54:47 2009	(r199567)
@@ -434,31 +434,27 @@ skip1:
 void
 nd6_llinfo_settimer_locked(struct llentry *ln, long tick)
 {
+	int canceled;
+
 	if (tick < 0) {
 		ln->la_expire = 0;
 		ln->ln_ntick = 0;
-		callout_stop(&ln->ln_timer_ch);
-		/*
-		 * XXX - do we know that there is
-		 * callout installed? i.e. are we 
-		 * guaranteed that we're not dropping
-		 * a reference that we did not add?
-		 * KMM 
-		 */
-		LLE_REMREF(ln);
+		canceled = callout_stop(&ln->ln_timer_ch);
 	} else {
 		ln->la_expire = time_second + tick / hz;
 		LLE_ADDREF(ln);
 		if (tick > INT_MAX) {
 			ln->ln_ntick = tick - INT_MAX;
-			callout_reset(&ln->ln_timer_ch, INT_MAX,
+			canceled = callout_reset(&ln->ln_timer_ch, INT_MAX,
 			    nd6_llinfo_timer, ln);
 		} else {
 			ln->ln_ntick = 0;
-			callout_reset(&ln->ln_timer_ch, tick,
+			canceled = callout_reset(&ln->ln_timer_ch, tick,
 			    nd6_llinfo_timer, ln);
 		}
 	}
+	if (canceled)
+		LLE_REMREF(ln);
 }
 
 void
@@ -1047,6 +1043,9 @@ nd6_free(struct llentry *ln, int gc)
 			else
 				nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
 			splx(s);
+			LLE_WLOCK(ln);
+			LLE_REMREF(ln);
+			LLE_WUNLOCK(ln);
 			return (LIST_NEXT(ln, lle_next));
 		}