Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/mld6.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/mld6.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.59
retrieving revision 1.69
diff -u -p -r1.59 -r1.69
--- src/sys/netinet6/mld6.c	2014/07/26 22:21:16	1.59
+++ src/sys/netinet6/mld6.c	2016/06/22 07:48:17	1.69
@@ -1,4 +1,4 @@
-/*	$NetBSD: mld6.c,v 1.59 2014/07/26 22:21:16 joerg Exp $	*/
+/*	$NetBSD: mld6.c,v 1.69 2016/06/22 07:48:17 ozaki-r Exp $	*/
 /*	$KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $	*/
 
 /*
@@ -102,9 +102,11 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.59 2014/07/26 22:21:16 joerg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.69 2016/06/22 07:48:17 ozaki-r Exp $");
 
+#ifdef _KERNEL_OPT
 #include "opt_inet.h"
+#endif
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -188,6 +190,7 @@ mld_init(void)
 	ip6_opts.ip6po_hbh = hbh;
 	/* We will specify the hoplimit by a multicast option. */
 	ip6_opts.ip6po_hlim = -1;
+	ip6_opts.ip6po_prefer_tempaddr = IP6PO_TEMPADDR_NOTPREFER;
 }
 
 static void
@@ -195,6 +198,8 @@ mld_starttimer(struct in6_multi *in6m)
 {
 	struct timeval now;
 
+	KASSERT(in6m->in6m_timer != IN6M_TIMER_UNDEF);
+
 	microtime(&now);
 	in6m->in6m_timer_expire.tv_sec = now.tv_sec + in6m->in6m_timer / hz;
 	in6m->in6m_timer_expire.tv_usec = now.tv_usec +
@@ -227,6 +232,9 @@ mld_timeo(void *arg)
 	mutex_enter(softnet_lock);
 	KERNEL_LOCK(1, NULL);
 
+	if (in6m->in6m_timer == IN6M_TIMER_UNDEF)
+		goto out;
+
 	in6m->in6m_timer = IN6M_TIMER_UNDEF;
 
 	switch (in6m->in6m_state) {
@@ -238,6 +246,7 @@ mld_timeo(void *arg)
 		break;
 	}
 
+out:
 	KERNEL_UNLOCK_ONE(NULL);
 	mutex_exit(softnet_lock);
 }
@@ -327,16 +336,18 @@ mld_input(struct mbuf *m, int off)
 {
 	struct ip6_hdr *ip6;
 	struct mld_hdr *mldh;
-	struct ifnet *ifp = m->m_pkthdr.rcvif;
+	struct ifnet *ifp;
 	struct in6_multi *in6m = NULL;
 	struct in6_addr mld_addr, all_in6;
 	struct in6_ifaddr *ia;
 	u_long timer = 0;	/* timer value in the MLD query header */
+	int s;
 
+	ifp = m_get_rcvif(m, &s);
 	IP6_EXTHDR_GET(mldh, struct mld_hdr *, m, off, sizeof(*mldh));
 	if (mldh == NULL) {
 		ICMP6_STATINC(ICMP6_STAT_TOOSHORT);
-		return;
+		goto out_nodrop;
 	}
 
 	/* source address validation */
@@ -366,8 +377,7 @@ mld_input(struct mbuf *m, int off)
 		    "mld_input: src %s is not link-local (grp=%s)\n",
 		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&mldh->mld_addr));
 #endif
-		m_freem(m);
-		return;
+		goto out;
 	}
 
 	/*
@@ -376,8 +386,7 @@ mld_input(struct mbuf *m, int off)
 	mld_addr = mldh->mld_addr;
 	if (in6_setscope(&mld_addr, ifp, NULL)) {
 		/* XXX: this should not happen! */
-		m_free(m);
-		return;
+		goto out;
 	}
 
 	/*
@@ -488,7 +497,10 @@ mld_input(struct mbuf *m, int off)
 		break;
 	}
 
+out:
 	m_freem(m);
+out_nodrop:
+	m_put_rcvif(ifp, &s);
 }
 
 static void
@@ -532,7 +544,7 @@ mld_sendpkt(struct in6_multi *in6m, int 
 
 	/* construct multicast option */
 	memset(&im6o, 0, sizeof(im6o));
-	im6o.im6o_multicast_ifp = ifp;
+	im6o.im6o_multicast_if_index = if_get_index(ifp);
 	im6o.im6o_multicast_hlim = 1;
 
 	/*
@@ -585,7 +597,7 @@ mld_allocbuf(struct mbuf **mh, int len, 
 	(*mh)->m_next = md;
 	md->m_next = NULL;
 
-	(*mh)->m_pkthdr.rcvif = NULL;
+	m_reset_rcvif((*mh));
 	(*mh)->m_pkthdr.len = sizeof(struct ip6_hdr) + len;
 	(*mh)->m_len = sizeof(struct ip6_hdr);
 	MH_ALIGN(*mh, sizeof(struct ip6_hdr));
@@ -649,15 +661,19 @@ in6_addmulti(struct in6_addr *maddr6, st
 		in6m->in6m_ifp = ifp;
 		in6m->in6m_refcount = 1;
 		in6m->in6m_timer = IN6M_TIMER_UNDEF;
+		callout_init(&in6m->in6m_timer_ch, CALLOUT_MPSAFE);
+		callout_setfunc(&in6m->in6m_timer_ch, mld_timeo, in6m);
+
 		IFP_TO_IA6(ifp, ia);
 		if (ia == NULL) {
+			callout_destroy(&in6m->in6m_timer_ch);
 			free(in6m, M_IPMADDR);
 			splx(s);
 			*errorp = EADDRNOTAVAIL; /* appropriate? */
 			return (NULL);
 		}
 		in6m->in6m_ia = ia;
-		IFAREF(&ia->ia_ifa); /* gain a reference */
+		ifaref(&ia->ia_ifa); /* gain a reference */
 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
 
 		/*
@@ -667,15 +683,14 @@ in6_addmulti(struct in6_addr *maddr6, st
 		sockaddr_in6_init(&sin6, maddr6, 0, 0, 0);
 		*errorp = if_mcast_op(ifp, SIOCADDMULTI, sin6tosa(&sin6));
 		if (*errorp) {
+			callout_destroy(&in6m->in6m_timer_ch);
 			LIST_REMOVE(in6m, in6m_entry);
 			free(in6m, M_IPMADDR);
-			IFAFREE(&ia->ia_ifa);
+			ifafree(&ia->ia_ifa);
 			splx(s);
 			return (NULL);
 		}
 
-		callout_init(&in6m->in6m_timer_ch, CALLOUT_MPSAFE);
-		callout_setfunc(&in6m->in6m_timer_ch, mld_timeo, in6m);
 		in6m->in6m_timer = timer;
 		if (in6m->in6m_timer > 0) {
 			in6m->in6m_state = MLD_REPORTPENDING;
@@ -719,7 +734,7 @@ in6_delmulti(struct in6_multi *in6m)
 		 */
 		LIST_REMOVE(in6m, in6m_entry);
 		if (in6m->in6m_ia != NULL) {
-			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
+			ifafree(&in6m->in6m_ia->ia_ifa); /* release reference */
 			in6m->in6m_ia = NULL;
 		}
 
@@ -741,7 +756,12 @@ in6_delmulti(struct in6_multi *in6m)
 		 */
 		sockaddr_in6_init(&sin6, &in6m->in6m_addr, 0, 0, 0);
 		if_mcast_op(in6m->in6m_ifp, SIOCDELMULTI, sin6tosa(&sin6));
+
+		/* Tell mld_timeo we're halting the timer */
+		in6m->in6m_timer = IN6M_TIMER_UNDEF;
+		callout_halt(&in6m->in6m_timer_ch, softnet_lock);
 		callout_destroy(&in6m->in6m_timer_ch);
+
 		free(in6m, M_IPMADDR);
 	}
 	splx(s);
@@ -798,8 +818,8 @@ in6_savemkludge(struct in6_ifaddr *oia)
 		KASSERT(ia != oia);
 		while ((in6m = LIST_FIRST(&oia->ia6_multiaddrs)) != NULL) {
 			LIST_REMOVE(in6m, in6m_entry);
-			IFAREF(&ia->ia_ifa);
-			IFAFREE(&in6m->in6m_ia->ia_ifa);
+			ifaref(&ia->ia_ifa);
+			ifafree(&in6m->in6m_ia->ia_ifa);
 			in6m->in6m_ia = ia;
 			LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
 		}
@@ -815,7 +835,7 @@ in6_savemkludge(struct in6_ifaddr *oia)
 
 		while ((in6m = LIST_FIRST(&oia->ia6_multiaddrs)) != NULL) {
 			LIST_REMOVE(in6m, in6m_entry);
-			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
+			ifafree(&in6m->in6m_ia->ia_ifa); /* release reference */
 			in6m->in6m_ia = NULL;
 			LIST_INSERT_HEAD(&mk->mk_head, in6m, in6m_entry);
 		}
@@ -842,7 +862,7 @@ in6_restoremkludge(struct in6_ifaddr *ia
 	while ((in6m = LIST_FIRST(&mk->mk_head)) != NULL) {
 		LIST_REMOVE(in6m, in6m_entry);
 		in6m->in6m_ia = ia;
-		IFAREF(&ia->ia_ifa);
+		ifaref(&ia->ia_ifa);
 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
 	}
 }
@@ -962,19 +982,22 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 	uint32_t tmp;
 	int error;
 	size_t written;
+	struct psref psref;
+	int bound;
 
 	if (namelen != 1)
 		return EINVAL;
 
-	ifp = if_byindex(name[0]);
-	if (ifp == NULL)
+	bound = curlwp_bind();
+	ifp = if_get_byindex(name[0], &psref);
+	if (ifp == NULL) {
+		curlwp_bindx(bound);
 		return ENODEV;
+	}
 
 	if (oldp == NULL) {
 		*oldlenp = 0;
 		IFADDR_FOREACH(ifa, ifp) {
-			if (ifa->ifa_addr == NULL)
-				continue;
 			if (ifa->ifa_addr->sa_family != AF_INET6)
 				continue;
 			ifa6 = (struct in6_ifaddr *)ifa;
@@ -983,14 +1006,14 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 				    sizeof(uint32_t);
 			}
 		}
+		if_put(ifp, &psref);
+		curlwp_bindx(bound);
 		return 0;
 	}
 
 	error = 0;
 	written = 0;
 	IFADDR_FOREACH(ifa, ifp) {
-		if (ifa->ifa_addr == NULL)
-			continue;
 		if (ifa->ifa_addr->sa_family != AF_INET6)
 			continue;
 		ifa6 = (struct in6_ifaddr *)ifa;
@@ -1019,6 +1042,8 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 		}
 	}
 done:
+	if_put(ifp, &psref);
+	curlwp_bindx(bound);
 	*oldlenp = written;
 	return error;
 }