Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/mld6.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/mld6.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.71
retrieving revision 1.75
diff -u -p -r1.71 -r1.75
--- src/sys/netinet6/mld6.c	2016/07/07 09:32:03	1.71
+++ src/sys/netinet6/mld6.c	2016/11/18 06:50:04	1.75
@@ -1,4 +1,4 @@
-/*	$NetBSD: mld6.c,v 1.71 2016/07/07 09:32:03 ozaki-r Exp $	*/
+/*	$NetBSD: mld6.c,v 1.75 2016/11/18 06:50:04 knakahara Exp $	*/
 /*	$KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $	*/
 
 /*
@@ -102,10 +102,11 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.71 2016/07/07 09:32:03 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.75 2016/11/18 06:50:04 knakahara Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
+#include "opt_net_mpsafe.h"
 #endif
 
 #include <sys/param.h>
@@ -402,7 +403,9 @@ mld_input(struct mbuf *m, int off)
 	 * if we sent the last report.
 	 */
 	switch (mldh->mld_type) {
-	case MLD_LISTENER_QUERY:
+	case MLD_LISTENER_QUERY: {
+		struct psref psref;
+
 		if (ifp->if_flags & IFF_LOOPBACK)
 			break;
 
@@ -428,10 +431,14 @@ mld_input(struct mbuf *m, int off)
 		 */
 		timer = ntohs(mldh->mld_maxdelay);
 
-		IFP_TO_IA6(ifp, ia);
+		ia = in6_get_ia_from_ifp_psref(ifp, &psref);
 		if (ia == NULL)
 			break;
 
+		/* The following operations may sleep */
+		m_put_rcvif(ifp, &s);
+		ifp = NULL;
+
 		LIST_FOREACH(in6m, &ia->ia6_multiaddrs, in6m_entry) {
 			if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &all_in6) ||
 			    IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) <
@@ -457,7 +464,9 @@ mld_input(struct mbuf *m, int off)
 				mld_starttimer(in6m);
 			}
 		}
+		ia6_release(ia, &psref);
 		break;
+	    }
 
 	case MLD_LISTENER_REPORT:
 		/*
@@ -514,6 +523,8 @@ mld_sendpkt(struct in6_multi *in6m, int 
 	struct in6_ifaddr *ia = NULL;
 	struct ifnet *ifp = in6m->in6m_ifp;
 	int ignflags;
+	struct psref psref;
+	int bound;
 
 	/*
 	 * At first, find a link local address on the outgoing interface
@@ -522,20 +533,31 @@ mld_sendpkt(struct in6_multi *in6m, int 
 	 * the case where we first join a link-local address.
 	 */
 	ignflags = (IN6_IFF_NOTREADY|IN6_IFF_ANYCAST) & ~IN6_IFF_TENTATIVE;
-	if ((ia = in6ifa_ifpforlinklocal(ifp, ignflags)) == NULL)
+	bound = curlwp_bind();
+	ia = in6ifa_ifpforlinklocal_psref(ifp, ignflags, &psref);
+	if (ia == NULL) {
+		curlwp_bindx(bound);
 		return;
-	if ((ia->ia6_flags & IN6_IFF_TENTATIVE))
+	}
+	if ((ia->ia6_flags & IN6_IFF_TENTATIVE)) {
+		ia6_release(ia, &psref);
 		ia = NULL;
+	}
 
 	/* Allocate two mbufs to store IPv6 header and MLD header */
 	mldh = mld_allocbuf(&mh, sizeof(struct mld_hdr), in6m, type);
-	if (mldh == NULL)
+	if (mldh == NULL) {
+		ia6_release(ia, &psref);
+		curlwp_bindx(bound);
 		return;
+	}
 
 	/* fill src/dst here */
  	ip6 = mtod(mh, struct ip6_hdr *);
  	ip6->ip6_src = ia ? ia->ia_addr.sin6_addr : in6addr_any;
  	ip6->ip6_dst = dst ? *dst : in6m->in6m_addr;
+	ia6_release(ia, &psref);
+	curlwp_bindx(bound);
 
 	mldh->mld_addr = in6m->in6m_addr;
 	in6_clearscope(&mldh->mld_addr); /* XXX */
@@ -645,6 +667,7 @@ in6_addmulti(struct in6_addr *maddr6, st
 		 */
 		in6m->in6m_refcount++;
 	} else {
+		int _s;
 		/*
 		 * New address; allocate a new multicast record
 		 * and link it into the interface's multicast list.
@@ -664,8 +687,10 @@ in6_addmulti(struct in6_addr *maddr6, st
 		callout_init(&in6m->in6m_timer_ch, CALLOUT_MPSAFE);
 		callout_setfunc(&in6m->in6m_timer_ch, mld_timeo, in6m);
 
-		IFP_TO_IA6(ifp, ia);
+		_s = pserialize_read_enter();
+		ia = in6_get_ia_from_ifp(ifp);
 		if (ia == NULL) {
+			pserialize_read_exit(_s);
 			callout_destroy(&in6m->in6m_timer_ch);
 			free(in6m, M_IPMADDR);
 			splx(s);
@@ -674,7 +699,9 @@ in6_addmulti(struct in6_addr *maddr6, st
 		}
 		in6m->in6m_ia = ia;
 		ifaref(&ia->ia_ifa); /* gain a reference */
+		/* FIXME NOMPSAFE: need to lock */
 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
+		pserialize_read_exit(_s);
 
 		/*
 		 * Ask the network driver to update its multicast reception
@@ -723,6 +750,8 @@ in6_delmulti(struct in6_multi *in6m)
 	mld_stoptimer(in6m);
 
 	if (--in6m->in6m_refcount == 0) {
+		int _s;
+
 		/*
 		 * No remaining claims to this record; let MLD6 know
 		 * that we are leaving the multicast group.
@@ -742,6 +771,7 @@ in6_delmulti(struct in6_multi *in6m)
 		 * Delete all references of this multicasting group from
 		 * the membership arrays
 		 */
+		_s = pserialize_read_enter();
 		IN6_ADDRLIST_READER_FOREACH(ia) {
 			struct in6_multi_mship *imm;
 			LIST_FOREACH(imm, &ia->ia6_memberships, i6mm_chain) {
@@ -749,6 +779,7 @@ in6_delmulti(struct in6_multi *in6m)
 					imm->i6mm_maddr = NULL;
 			}
 		}
+		pserialize_read_exit(_s);
 
 		/*
 		 * Notify the network driver to update its multicast
@@ -759,7 +790,11 @@ in6_delmulti(struct in6_multi *in6m)
 
 		/* Tell mld_timeo we're halting the timer */
 		in6m->in6m_timer = IN6M_TIMER_UNDEF;
+#ifdef NET_MPSAFE
+		callout_halt(&in6m->in6m_timer_ch, NULL);
+#else
 		callout_halt(&in6m->in6m_timer_ch, softnet_lock);
+#endif
 		callout_destroy(&in6m->in6m_timer_ch);
 
 		free(in6m, M_IPMADDR);
@@ -812,8 +847,10 @@ in6_savemkludge(struct in6_ifaddr *oia)
 {
 	struct in6_ifaddr *ia;
 	struct in6_multi *in6m;
+	int s;
 
-	IFP_TO_IA6(oia->ia_ifp, ia);
+	s = pserialize_read_enter();
+	ia = in6_get_ia_from_ifp(oia->ia_ifp);
 	if (ia) {	/* there is another address */
 		KASSERT(ia != oia);
 		while ((in6m = LIST_FIRST(&oia->ia6_multiaddrs)) != NULL) {
@@ -821,6 +858,7 @@ in6_savemkludge(struct in6_ifaddr *oia)
 			ifaref(&ia->ia_ifa);
 			ifafree(&in6m->in6m_ia->ia_ifa);
 			in6m->in6m_ia = ia;
+			/* FIXME NOMPSAFE: need to lock */
 			LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
 		}
 	} else {	/* last address on this if deleted, save */
@@ -840,6 +878,7 @@ in6_savemkludge(struct in6_ifaddr *oia)
 			LIST_INSERT_HEAD(&mk->mk_head, in6m, in6m_entry);
 		}
 	}
+	pserialize_read_exit(s);
 }
 
 /*
@@ -982,8 +1021,8 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 	uint32_t tmp;
 	int error;
 	size_t written;
-	struct psref psref;
-	int bound;
+	struct psref psref, psref_ia;
+	int bound, s;
 
 	if (namelen != 1)
 		return EINVAL;
@@ -997,6 +1036,7 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 
 	if (oldp == NULL) {
 		*oldlenp = 0;
+		s = pserialize_read_enter();
 		IFADDR_READER_FOREACH(ifa, ifp) {
 			if (ifa->ifa_addr->sa_family != AF_INET6)
 				continue;
@@ -1006,6 +1046,7 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 				    sizeof(uint32_t);
 			}
 		}
+		pserialize_read_exit(s);
 		if_put(ifp, &psref);
 		curlwp_bindx(bound);
 		return 0;
@@ -1013,9 +1054,14 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 
 	error = 0;
 	written = 0;
+	s = pserialize_read_enter();
 	IFADDR_READER_FOREACH(ifa, ifp) {
 		if (ifa->ifa_addr->sa_family != AF_INET6)
 			continue;
+
+		ifa_acquire(ifa, &psref_ia);
+		pserialize_read_exit(s);
+
 		ifa6 = (struct in6_ifaddr *)ifa;
 		LIST_FOREACH(in6m, &ifa6->ia6_multiaddrs, in6m_entry) {
 			if (written + 2 * sizeof(struct in6_addr) +
@@ -1040,8 +1086,13 @@ in6_multicast_sysctl(SYSCTLFN_ARGS)
 			oldp = (char *)oldp + sizeof(tmp);
 			written += sizeof(tmp);
 		}
+
+		s = pserialize_read_enter();
+		ifa_release(ifa, &psref_ia);
 	}
+	pserialize_read_exit(s);
 done:
+	ifa_release(ifa, &psref_ia);
 	if_put(ifp, &psref);
 	curlwp_bindx(bound);
 	*oldlenp = written;