From owner-svn-src-head@FreeBSD.ORG Fri Feb 13 21:21:33 2015 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B03553B4; Fri, 13 Feb 2015 21:21:33 +0000 (UTC) Received: from cell.glebius.int.ru (glebius.int.ru [81.19.69.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "cell.glebius.int.ru", Issuer "cell.glebius.int.ru" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 1C9BACC0; Fri, 13 Feb 2015 21:21:32 +0000 (UTC) Received: from cell.glebius.int.ru (localhost [127.0.0.1]) by cell.glebius.int.ru (8.14.9/8.14.9) with ESMTP id t1DLLScN033116 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 14 Feb 2015 00:21:28 +0300 (MSK) (envelope-from glebius@FreeBSD.org) Received: (from glebius@localhost) by cell.glebius.int.ru (8.14.9/8.14.9/Submit) id t1DLLSfp033115; Sat, 14 Feb 2015 00:21:28 +0300 (MSK) (envelope-from glebius@FreeBSD.org) X-Authentication-Warning: cell.glebius.int.ru: glebius set sender to glebius@FreeBSD.org using -f Date: Sat, 14 Feb 2015 00:21:28 +0300 From: Gleb Smirnoff To: John Baldwin Subject: Re: svn commit: r278472 - in head/sys: netinet netinet6 Message-ID: <20150213212128.GG15484@FreeBSD.org> References: <201502091928.t19JSC5P066293@svn.freebsd.org> <1903622.i3cFFNVYcL@ralph.baldwin.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1903622.i3cFFNVYcL@ralph.baldwin.cx> User-Agent: Mutt/1.5.23 (2014-03-12) Cc: src-committers@freebsd.org, Eric van Gyzen , svn-src-all@freebsd.org, Randall Stewart , svn-src-head@freebsd.org, zont@FreeBSD.org, rstone@FreeBSD.org X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Feb 2015 21:21:33 -0000 On Mon, Feb 09, 2015 at 03:11:21PM -0500, John Baldwin wrote: J> On Monday, February 09, 2015 07:28:12 PM Randall Stewart wrote: J> > Author: rrs J> > Date: Mon Feb 9 19:28:11 2015 J> > New Revision: 278472 J> > URL: https://svnweb.freebsd.org/changeset/base/278472 J> > J> > Log: J> > This fixes a bug in the way that the LLE timers for nd6 J> > and arp were being used. They basically would pass in the J> > mutex to the callout_init. Because they used this method J> > to the callout system, it was possible to "stop" the callout. J> > When flushing the table and you stopped the running callout, the J> > callout_stop code would return 1 indicating that it was going J> > to stop the callout (that was about to run on the callout_wheel blocked J> > by the function calling the stop). Now when 1 was returned, it would J> > lower the reference count one extra time for the stopped timer, then J> > a few lines later delete the memory. Of course the callout_wheel was J> > stuck in the lock code and would then crash since it was accessing J> > freed memory. By using callout_init(c, 1) we always get a 0 back J> > and the reference counting bug does not rear its head. We do have J> > to make a few adjustments to the callouts themselves though to make J> > sure it does the proper thing if rescheduled as well as gets the lock. J> > J> > Commented upon by hiren and sbruno J> > See Phabricator D1777 for more details. J> > J> > Commented upon by hiren and sbruno J> > Reviewed by: adrian, jhb and bz J> > Sponsored by: Netflix Inc. J> J> Eh, I looked at it, but I really, really don't like it. I think J> callout_init_*() should be preferred to CALLOUT_MPSAFE whenever possible as it J> is less race-prone. I think this should probably be fixed by adding Hans' J> callout_drain_async() instead, though this is fine as a temporary workaround. I second concerns. Please look at kern/165863 and r238990 that fixed it. Transition from CALLOUT_MPSAFE to callout_init_rw() was intentional and fixed races. I added to Cc guys who helped to track down that races. May be someone still has test scripts at hand. AFAIR, there were some that allowed to put a box down quite quickly. -- Totus tuus, Glebius.