From: Alexander Bluhm <bluhm@openbsd.org>
Subject: Re: Ulock ICMPV6CTL_ND6_UMAXTRIES case of icmp6_sysctl()
To: Vitaliy Makkoveev <mvs@openbsd.org>
Cc: tech@openbsd.org
Date: Sun, 3 Aug 2025 12:05:52 +0200

On Sun, Aug 03, 2025 at 07:08:42AM +0300, Vitaliy Makkoveev wrote:
> `nd6_umaxtries' loaded only once in nd6_llinfo_timer().

OK bluhm@

> Index: sys/netinet6/icmp6.c
> ===================================================================
> RCS file: /cvs/src/sys/netinet6/icmp6.c,v
> retrieving revision 1.273
> diff -u -p -r1.273 icmp6.c
> --- sys/netinet6/icmp6.c	2 Aug 2025 12:53:04 -0000	1.273
> +++ sys/netinet6/icmp6.c	3 Aug 2025 04:01:21 -0000
> @@ -1776,10 +1776,10 @@ icmp6_mtudisc_timeout(struct rtentry *rt
>  #ifndef SMALL_KERNEL
>  const struct sysctl_bounded_args icmpv6ctl_vars_unlocked[] = {
>  	{ ICMPV6CTL_ND6_DELAY, &nd6_delay, 0, INT_MAX },
> +	{ ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
>  };
>  
>  const struct sysctl_bounded_args icmpv6ctl_vars[] = {
> -	{ ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
>  	{ ICMPV6CTL_ND6_MMAXTRIES, &nd6_mmaxtries, 0, INT_MAX },
>  	{ ICMPV6CTL_ERRPPSLIMIT, &icmp6errppslim, -1, 1000 },
>  	{ ICMPV6CTL_ND6_MAXNUDHINT, &nd6_maxnudhint, 0, INT_MAX },
> @@ -1847,6 +1847,7 @@ icmp6_sysctl(int *name, u_int namelen, v
>  		break;
>  
>  	case ICMPV6CTL_ND6_DELAY:
> +	case ICMPV6CTL_ND6_UMAXTRIES:
>  		error = sysctl_bounded_arr(icmpv6ctl_vars_unlocked,
>  		    nitems(icmpv6ctl_vars_unlocked), name, namelen,
>  		    oldp, oldlenp, newp, newlen);
> Index: sys/netinet6/nd6.c
> ===================================================================
> RCS file: /cvs/src/sys/netinet6/nd6.c,v
> retrieving revision 1.294
> diff -u -p -r1.294 nd6.c
> --- sys/netinet6/nd6.c	2 Aug 2025 12:53:04 -0000	1.294
> +++ sys/netinet6/nd6.c	3 Aug 2025 04:01:21 -0000
> @@ -76,7 +76,7 @@
>  int	nd6_timer_next	= -1;	/* at which uptime nd6_timer runs */
>  time_t	nd6_expire_next	= -1;	/* at which uptime nd6_expire runs */
>  int	nd6_delay	= 5;	/* [a] delay first probe time 5 second */
> -int	nd6_umaxtries	= 3;	/* maximum unicast query */
> +int	nd6_umaxtries	= 3;	/* [a] maximum unicast query */
>  int	nd6_mmaxtries	= 3;	/* maximum multicast query */
>  int	nd6_gctimer	= (60 * 60 * 24); /* 1 day: garbage collection timer */
>  
> @@ -360,7 +360,7 @@ nd6_llinfo_timer(struct rtentry *rt, int
>  		break;
>  
>  	case ND6_LLINFO_PROBE:
> -		if (ln->ln_asked < nd6_umaxtries) {
> +		if (ln->ln_asked < atomic_load_int(&nd6_umaxtries)) {
>  			ln->ln_asked++;
>  			nd6_llinfo_settimer(ln, RETRANS_TIMER / 1000);
>  			nd6_ns_output(ifp, &dst->sin6_addr, &dst->sin6_addr,