From: Vitaliy Makkoveev <mvs@openbsd.org>
Subject: Ulock ICMPV6CTL_ND6_UMAXTRIES case of icmp6_sysctl()
To: Alexander Bluhm <bluhm@openbsd.org>, tech@openbsd.org
Date: Sun, 3 Aug 2025 07:08:42 +0300

`nd6_umaxtries' loaded only once in nd6_llinfo_timer().

Index: sys/netinet6/icmp6.c
===================================================================
RCS file: /cvs/src/sys/netinet6/icmp6.c,v
retrieving revision 1.273
diff -u -p -r1.273 icmp6.c
--- sys/netinet6/icmp6.c	2 Aug 2025 12:53:04 -0000	1.273
+++ sys/netinet6/icmp6.c	3 Aug 2025 04:01:21 -0000
@@ -1776,10 +1776,10 @@ icmp6_mtudisc_timeout(struct rtentry *rt
 #ifndef SMALL_KERNEL
 const struct sysctl_bounded_args icmpv6ctl_vars_unlocked[] = {
 	{ ICMPV6CTL_ND6_DELAY, &nd6_delay, 0, INT_MAX },
+	{ ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
 };
 
 const struct sysctl_bounded_args icmpv6ctl_vars[] = {
-	{ ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
 	{ ICMPV6CTL_ND6_MMAXTRIES, &nd6_mmaxtries, 0, INT_MAX },
 	{ ICMPV6CTL_ERRPPSLIMIT, &icmp6errppslim, -1, 1000 },
 	{ ICMPV6CTL_ND6_MAXNUDHINT, &nd6_maxnudhint, 0, INT_MAX },
@@ -1847,6 +1847,7 @@ icmp6_sysctl(int *name, u_int namelen, v
 		break;
 
 	case ICMPV6CTL_ND6_DELAY:
+	case ICMPV6CTL_ND6_UMAXTRIES:
 		error = sysctl_bounded_arr(icmpv6ctl_vars_unlocked,
 		    nitems(icmpv6ctl_vars_unlocked), name, namelen,
 		    oldp, oldlenp, newp, newlen);
Index: sys/netinet6/nd6.c
===================================================================
RCS file: /cvs/src/sys/netinet6/nd6.c,v
retrieving revision 1.294
diff -u -p -r1.294 nd6.c
--- sys/netinet6/nd6.c	2 Aug 2025 12:53:04 -0000	1.294
+++ sys/netinet6/nd6.c	3 Aug 2025 04:01:21 -0000
@@ -76,7 +76,7 @@
 int	nd6_timer_next	= -1;	/* at which uptime nd6_timer runs */
 time_t	nd6_expire_next	= -1;	/* at which uptime nd6_expire runs */
 int	nd6_delay	= 5;	/* [a] delay first probe time 5 second */
-int	nd6_umaxtries	= 3;	/* maximum unicast query */
+int	nd6_umaxtries	= 3;	/* [a] maximum unicast query */
 int	nd6_mmaxtries	= 3;	/* maximum multicast query */
 int	nd6_gctimer	= (60 * 60 * 24); /* 1 day: garbage collection timer */
 
@@ -360,7 +360,7 @@ nd6_llinfo_timer(struct rtentry *rt, int
 		break;
 
 	case ND6_LLINFO_PROBE:
-		if (ln->ln_asked < nd6_umaxtries) {
+		if (ln->ln_asked < atomic_load_int(&nd6_umaxtries)) {
 			ln->ln_asked++;
 			nd6_llinfo_settimer(ln, RETRANS_TIMER / 1000);
 			nd6_ns_output(ifp, &dst->sin6_addr, &dst->sin6_addr,