From owner-freebsd-net@FreeBSD.ORG Mon Apr 9 21:46:19 2012 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 986D21065670 for ; Mon, 9 Apr 2012 21:46:19 +0000 (UTC) (envelope-from qing.li@bluecoat.com) Received: from plsvl-mailgw-01.bluecoat.com (plsvl-mailgw-01.bluecoat.com [199.91.133.11]) by mx1.freebsd.org (Postfix) with ESMTP id 75EDB8FC12 for ; Mon, 9 Apr 2012 21:46:19 +0000 (UTC) Received: from PWSVL-EXCHTS-02.internal.cacheflow.com (unknown [10.2.2.126]) by plsvl-mailgw-01.bluecoat.com (Postfix) with ESMTP id 2F24A81A0D5; Mon, 9 Apr 2012 13:47:36 -0700 (PDT) Received: from pwsvl-excmbx-05.internal.cacheflow.com ([fe80::f848:d461:9aa9:59a8]) by PWSVL-EXCHTS-02.internal.cacheflow.com ([fe80::4910:317f:407:6ecc%14]) with mapi id 14.01.0289.001; Mon, 9 Apr 2012 14:46:18 -0700 From: "Li, Qing" To: Ryan Stone Thread-Topic: Removing an IPv6 address does not remove NDP entries on that subnet Thread-Index: AQHNDnkgJRkO9YzfY0abvrST7SLcoJaH0pmQgAtDFAA= Date: Mon, 9 Apr 2012 21:46:18 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [199.91.133.85] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: freebsd-net Subject: RE: Removing an IPv6 address does not remove NDP entries on that subnet X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Apr 2012 21:46:19 -0000 WRT the IF_AFDATA_LOCK() race condition you mentioned, I re-run the tests=20 that I used when I developed that code, but I haven't run into any issues,= =20 but that doesn't mean there isn't a bug. Could you please share with me a call path that you believe is=20 problematic, or a simple test case that uncovers the issue ? --Qing =20 > -----Original Message----- > From: owner-freebsd-net@freebsd.org [mailto:owner-freebsd- > net@freebsd.org] On Behalf Of Li, Qing > Sent: Monday, April 02, 2012 10:54 AM > To: Ryan Stone > Cc: freebsd-net > Subject: RE: Removing an IPv6 address does not remove NDP entries on > that subnet >=20 > > > > On Fri, Mar 30, 2012 at 12:28 AM, Li, Qing > wrote: > > >> * In a way this is a good thing as in6_lltable_prefix_free() is > > >> guaranteed to crash your kernel in two different ways, and that's > > not > > >> counting the race conditions that it's subject to. > > >> > > > > > > =A0 =A0 =A0 =A0Could you please elaborate with some details on the tw= o > > different > > > =A0 =A0 =A0 =A0ways in6_lltable_prefix_free() crashes the kernel > > definitively ? > > > > First, it calls callout_drain on lle->le_timer, but that is never > > initialized for a v6 llentry. Second, it never stops the ln_timer_ch > > callout before it frees the llentry. Third, it modifies the lltable > > without holding IF_AFDATA_LOCK(in.c has the third problem: see the > > -net discussion about kern/165863). >=20 >=20 > 1. The reference to &lle->la_timer instead of ln_timer_ch is fine > because lle_timer is defined as a union. >=20 > 2. The manpage of "callout_drain()" reads >=20 > "The function callout_drain() is identical to callout_stop() except > that it will wait for the callout to be completed if it is already > in progress." >=20 > 3. wrt IF_AFDATA_LOCK() I will check again. >=20 > --Qing >=20 >=20 > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"