Date: Fri, 20 Nov 2009 06:54:47 +0000 (UTC) From: Hajimu UMEMOTO <ume@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org Subject: svn commit: r199567 - stable/8/sys/netinet6 Message-ID: <200911200654.nAK6slMl032072@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ume Date: Fri Nov 20 06:54:47 2009 New Revision: 199567 URL: http://svn.freebsd.org/changeset/base/199567 Log: MFC r199225: - We are not guaranteed that we're not dropping a reference that we did not add. Call LLE_REMREF() only when callout_stop() actually canceled a pending callout. - callout_reset() may cancel a pending callout. When callout_reset() canceled a pending callout, call LLE_REMREF() to drop a reference for the canceled callout. Modified: stable/8/sys/netinet6/nd6.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/amd64/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/arm/ (props changed) stable/8/sys/boot/ (props changed) stable/8/sys/bsm/ (props changed) stable/8/sys/cddl/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/compat/ (props changed) stable/8/sys/contrib/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/crypto/ (props changed) stable/8/sys/ddb/ (props changed) stable/8/sys/dev/xen/xenpci/ (props changed) stable/8/sys/fs/ (props changed) stable/8/sys/gdb/ (props changed) stable/8/sys/geom/ (props changed) stable/8/sys/gnu/ (props changed) stable/8/sys/i386/acpica/ (props changed) stable/8/sys/i386/bios/ (props changed) stable/8/sys/i386/compile/ (props changed) stable/8/sys/i386/cpufreq/ (props changed) stable/8/sys/i386/i386/ (props changed) stable/8/sys/i386/ibcs2/ (props changed) stable/8/sys/i386/include/ (props changed) stable/8/sys/i386/isa/ (props changed) stable/8/sys/i386/linux/ (props changed) stable/8/sys/i386/pci/ (props changed) stable/8/sys/i386/svr4/ (props changed) stable/8/sys/i386/xbox/ (props changed) stable/8/sys/i386/xen/ (props changed) stable/8/sys/ia64/ (props changed) stable/8/sys/isa/ (props changed) stable/8/sys/kern/ (props changed) stable/8/sys/kgssapi/ (props changed) stable/8/sys/libkern/ (props changed) stable/8/sys/mips/ (props changed) stable/8/sys/modules/ (props changed) stable/8/sys/net80211/ (props changed) stable/8/sys/netatalk/ (props changed) stable/8/sys/netgraph/ (props changed) stable/8/sys/netinet/ (props changed) stable/8/sys/netipsec/ (props changed) stable/8/sys/netipx/ (props changed) stable/8/sys/netnatm/ (props changed) stable/8/sys/netncp/ (props changed) stable/8/sys/netsmb/ (props changed) stable/8/sys/nfs/ (props changed) stable/8/sys/nfsclient/ (props changed) stable/8/sys/nfsserver/ (props changed) stable/8/sys/nlm/ (props changed) stable/8/sys/opencrypto/ (props changed) stable/8/sys/pc98/ (props changed) stable/8/sys/pci/ (props changed) stable/8/sys/powerpc/ (props changed) stable/8/sys/rpc/ (props changed) stable/8/sys/security/ (props changed) stable/8/sys/sparc64/ (props changed) stable/8/sys/sun4v/ (props changed) stable/8/sys/sys/ (props changed) stable/8/sys/tools/ (props changed) stable/8/sys/ufs/ (props changed) stable/8/sys/vm/ (props changed) stable/8/sys/xdr/ (props changed) stable/8/sys/xen/ (props changed) Modified: stable/8/sys/netinet6/nd6.c ============================================================================== --- stable/8/sys/netinet6/nd6.c Fri Nov 20 03:14:54 2009 (r199566) +++ stable/8/sys/netinet6/nd6.c Fri Nov 20 06:54:47 2009 (r199567) @@ -434,31 +434,27 @@ skip1: void nd6_llinfo_settimer_locked(struct llentry *ln, long tick) { + int canceled; + if (tick < 0) { ln->la_expire = 0; ln->ln_ntick = 0; - callout_stop(&ln->ln_timer_ch); - /* - * XXX - do we know that there is - * callout installed? i.e. are we - * guaranteed that we're not dropping - * a reference that we did not add? - * KMM - */ - LLE_REMREF(ln); + canceled = callout_stop(&ln->ln_timer_ch); } else { ln->la_expire = time_second + tick / hz; LLE_ADDREF(ln); if (tick > INT_MAX) { ln->ln_ntick = tick - INT_MAX; - callout_reset(&ln->ln_timer_ch, INT_MAX, + canceled = callout_reset(&ln->ln_timer_ch, INT_MAX, nd6_llinfo_timer, ln); } else { ln->ln_ntick = 0; - callout_reset(&ln->ln_timer_ch, tick, + canceled = callout_reset(&ln->ln_timer_ch, tick, nd6_llinfo_timer, ln); } } + if (canceled) + LLE_REMREF(ln); } void @@ -1047,6 +1043,9 @@ nd6_free(struct llentry *ln, int gc) else nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz); splx(s); + LLE_WLOCK(ln); + LLE_REMREF(ln); + LLE_WUNLOCK(ln); return (LIST_NEXT(ln, lle_next)); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200911200654.nAK6slMl032072>