Loosen the locking in nd6-free() again after r216022 to avoid

a LOR and a recursed lock.

Reported by:	delphij
Tested by:	delphij
PR:		kern/148857
MFC After:	3 days

1 files changed, 24 insertions, 13 deletions

diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index c4ff308f8573..fe8bada296de 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -1053,15 +1053,6 @@ nd6_free(struct llentry *ln, int gc)
 			return (next);
 		}
 
-		if (ln->ln_router || dr) {
-			/*
-			 * rt6_flush must be called whether or not the neighbor
-			 * is in the Default Router List.
-			 * See a corresponding comment in nd6_na_input().
-			 */
-			rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ifp);
-		}
-
 		if (dr) {
 			/*
 			 * Unreachablity of a router might affect the default
@@ -1077,8 +1068,28 @@ nd6_free(struct llentry *ln, int gc)
 			 * or the entry itself will be deleted.
 			 */
 			ln->ln_state = ND6_LLINFO_INCOMPLETE;
+		}
+
+		if (ln->ln_router || dr) {
 
 			/*
+			 * We need to unlock to avoid a LOR with rt6_flush() with the
+			 * rnh and for the calls to pfxlist_onlink_check() and
+			 * defrouter_select() in the block further down for calls
+			 * into nd6_lookup().  We still hold a ref.
+			 */
+			LLE_WUNLOCK(ln);
+
+			/*
+			 * rt6_flush must be called whether or not the neighbor
+			 * is in the Default Router List.
+			 * See a corresponding comment in nd6_na_input().
+			 */
+			rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ifp);
+		}
+
+		if (dr) {
+			/*
 			 * Since defrouter_select() does not affect the
 			 * on-link determination and MIP6 needs the check
 			 * before the default router selection, we perform
@@ -1087,13 +1098,13 @@ nd6_free(struct llentry *ln, int gc)
 			pfxlist_onlink_check();
 
 			/*
-			 * Refresh default router list.  Have to unlock as
-			 * it calls into nd6_lookup(), still holding a ref.
+			 * Refresh default router list.
 			 */
-			LLE_WUNLOCK(ln);
 			defrouter_select();
-			LLE_WLOCK(ln);
 		}
+
+		if (ln->ln_router || dr)
+			LLE_WLOCK(ln);
 	}
 
 	/*