[Bug 225927] [panic] NULL pointer dereference in nd6_llinfo_timer()

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225927

--- Comment #4 from Andrey V. Elsukov <ae at FreeBSD.org> ---
(In reply to Hans Petter Selasky from comment #3)
> Can you try the patch in D4605 ?

This problem is not easy to trigger and I'm not sure that the patch solves it.
I think how it happens:
on ifnet departure in6_domifdetach() is called, then lltable_free() unlinks
lltable and acquires LLE_WLOCK for each llentry. While we are acquiring all
these locks it is possible, that callout for some entry has been started and
blocked on the LLE_WLOCK() since lock is held by lltable_free(). Then
llentry_free() releases LLE_WLOCK(), and nd6_llinfo_timer() acquires it. Now we
have invalid ifp pointer, it is strange enough that it is NULL...

About your patch, it seems the code:

  if (callout_stop(&lle->lle_timer) > 0)
      LLE_REMREF(lle);

can be placed in the llentry_free() only once, and also removed from
lltable_free(). But it doesn't protect from described scenario. I think we need
somehow handle the case when nd6_llinfo_timer() is already active, but it
hasn't obtained lock yet.

-- 
You are receiving this mail because:
You are the assignee for the bug.