[PATCH 2/2][IPV6] addrconf: fix addrconf_del_timer locking etc.

[Jarek Poplawski <jarkao2@o2.pl>]

addrconf_del_timer() is sometimes done without a lock.
IMHO it could be racy e.g. when between del_timer() and
__in6_ifa_put() some other in6_ifa_put() is done.

addrconf_dad_kick() also runs unlocked in one place. 

BTW, I changed a bit one printk to be more precise, I hope.

PS: this patch was prepared on 2.6.22-rc7 with my neighbouring
PATCH 1/2, but they could be applied independently too.


Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>

---

diff -Nurp 2.6.22-rc7-1_2/net/ipv6/addrconf.c 2.6.22-rc7-2_2/net/ipv6/addrconf.c
--- 2.6.22-rc7-1_2/net/ipv6/addrconf.c	2007-07-05 12:33:34.000000000 +0200
+++ 2.6.22-rc7-2_2/net/ipv6/addrconf.c	2007-07-05 12:39:51.000000000 +0200
@@ -477,7 +477,7 @@ void inet6_ifa_finish_destroy(struct ine
 	in6_dev_put(ifp->idev);
 
 	if (del_timer(&ifp->timer))
-		printk("Timer is still running, when freeing ifa=%p\n", ifp);
+		printk("Timer is still pending, when freeing ifa=%p\n", ifp);
 
 	if (!ifp->dead) {
 		printk("Freeing alive inet6 address %p\n", ifp);
@@ -698,7 +698,9 @@ static void ipv6_del_addr(struct inet6_i
 
 	atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp);
 
+	spin_lock_bh(&ifp->lock);
 	addrconf_del_timer(ifp);
+	spin_unlock_bh(&ifp->lock);
 
 	/*
 	 * Purge or update corresponding prefix
@@ -2427,7 +2429,9 @@ static int addrconf_ifdown(struct net_de
 			if (ifa->idev == idev) {
 				*bifa = ifa->lst_next;
 				ifa->lst_next = NULL;
+				spin_lock_bh(&ifa->lock);
 				addrconf_del_timer(ifa);
+				spin_unlock_bh(&ifa->lock);
 				in6_ifa_put(ifa);
 				continue;
 			}
@@ -2468,9 +2472,11 @@ static int addrconf_ifdown(struct net_de
 		idev->addr_list = ifa->if_next;
 		ifa->if_next = NULL;
 		ifa->dead = 1;
-		addrconf_del_timer(ifa);
 		write_unlock_bh(&idev->lock);
 
+		spin_lock_bh(&ifa->lock);
+		addrconf_del_timer(ifa);
+		spin_unlock_bh(&ifa->lock);
 		__ipv6_ifa_notify(RTM_DELADDR, ifa);
 		in6_ifa_put(ifa);
 
@@ -2701,8 +2707,8 @@ static void addrconf_dad_run(struct inet
 			spin_unlock_bh(&ifp->lock);
 			continue;
 		}
-		spin_unlock_bh(&ifp->lock);
 		addrconf_dad_kick(ifp);
+		spin_unlock_bh(&ifp->lock);
 	}
 	read_unlock_bh(&idev->lock);
 }