6684689 ilg_add can add a dysfunctional multicast entry leading to potential ifconfig hangs.

6685199 rename {ipif, ill}_cnt_<foo> to {ipif, ill}_<foo>_cnt

6 files changed, 87 insertions, 67 deletions

diff --git a/usr/src/uts/common/inet/ip.h b/usr/src/uts/common/inet/ip.h
index 4b5966d1b2..c074ad48c4 100644
--- a/usr/src/uts/common/inet/ip.h
+++ b/usr/src/uts/common/inet/ip.h
@@ -1313,9 +1313,9 @@ typedef struct ipif_s {
 	uint_t	ipif_state_flags;	/* See IPIF_* flag defs above */
 	uint_t	ipif_refcnt;		/* active consistent reader cnt */
 
-	/* Number of ire's and ilm's referencing ipif */
-	uint_t	ipif_cnt_ire;
-	uint_t	ipif_cnt_ilm;
+	/* Number of ire's and ilm's referencing this ipif */
+	uint_t	ipif_ire_cnt;
+	uint_t	ipif_ilm_cnt;
 
 	uint_t  ipif_saved_ire_cnt;
 	zoneid_t ipif_zoneid;		/* zone ID number */
@@ -1328,7 +1328,7 @@ typedef struct ipif_s {
  * to the ipif. Incoming refs would prevent the ipif from being freed.
  */
 #define	IPIF_FREE_OK(ipif)	\
-	((ipif)->ipif_cnt_ire == 0 && (ipif)->ipif_cnt_ilm == 0)
+	((ipif)->ipif_ire_cnt == 0 && (ipif)->ipif_ilm_cnt == 0)
 /*
  * IPIF_DOWN_OK() determines whether the incoming pointer reference counts
  * would permit the ipif to be considered quiescent. In order for
@@ -1351,8 +1351,7 @@ typedef struct ipif_s {
  * down address. Therefore the ilm references are not included in
  * the _DOWN_OK macros.
  */
-#define	IPIF_DOWN_OK(ipif)		((ipif)->ipif_cnt_ire == 0)
-
+#define	IPIF_DOWN_OK(ipif)		((ipif)->ipif_ire_cnt == 0)
 
 /*
  * The following table lists the protection levels of the various members
@@ -1405,8 +1404,8 @@ typedef struct ipif_s {
  *
  * ipif_state_flags	ill_lock		ill_lock
  * ipif_refcnt		ill_lock		ill_lock
- * ipif_cnt_ire		ill_lock		ill_lock
- * ipif_cnt_ilm		ill_lock		ill_lock
+ * ipif_ire_cnt		ill_lock		ill_lock
+ * ipif_ilm_cnt		ill_lock		ill_lock
  * ipif_saved_ire_cnt
  */
 
@@ -1981,10 +1980,10 @@ typedef struct ill_s {
 	avl_node_t	ill_avl_byppa; /* avl node based on ppa */
 	void		*ill_fastpath_list; /* both ire and nce hang off this */
 	uint_t		ill_refcnt;	/* active refcnt by threads */
-	uint_t		ill_cnt_ire;	/* ires associated with this ill */
+	uint_t		ill_ire_cnt;	/* ires associated with this ill */
 	kcondvar_t	ill_cv;
 	uint_t		ill_ilm_walker_cnt;	/* snmp ilm walkers */
-	uint_t		ill_cnt_nce;	/* nces associated with this ill */
+	uint_t		ill_nce_cnt;	/* nces associated with this ill */
 	uint_t		ill_waiters;	/* threads waiting in ipsq_enter */
 	/*
 	 * Contains the upper read queue pointer of the module immediately
@@ -2001,16 +2000,16 @@ typedef struct ill_s {
 	zoneid_t	ill_zoneid;
 	ip_stack_t	*ill_ipst;	/* Corresponds to a netstack_hold */
 	uint32_t	ill_dhcpinit;	/* IP_DHCPINIT_IFs for ill */
-	uint_t		ill_cnt_ilm;
+	uint_t		ill_ilm_cnt;    /* ilms referencing this ill */
 } ill_t;
 
 /*
- * ILL_FREE_OK() means that there are no incoming references
+ * ILL_FREE_OK() means that there are no incoming pointer references
  * to the ill.
  */
 #define	ILL_FREE_OK(ill)					\
-	((ill)->ill_cnt_ire == 0 && (ill)->ill_cnt_ilm == 0 &&	\
-	(ill)->ill_cnt_nce == 0)
+	((ill)->ill_ire_cnt == 0 && (ill)->ill_ilm_cnt == 0 &&	\
+	(ill)->ill_nce_cnt == 0)
 
 /*
  * An ipif/ill can be marked down only when the ire and nce references
@@ -2018,7 +2017,7 @@ typedef struct ill_s {
  * quiescence checks. See comments above IPIF_DOWN_OK for details
  * on why ires and nces are selectively considered for this macro.
  */
-#define	ILL_DOWN_OK(ill)	(ill->ill_cnt_ire == 0 && ill->ill_cnt_nce == 0)
+#define	ILL_DOWN_OK(ill)	(ill->ill_ire_cnt == 0 && ill->ill_nce_cnt == 0)
 
 /*
  * The following table lists the protection levels of the various members
@@ -2113,11 +2112,11 @@ typedef struct ill_s {
  *
  * ill_fastpath_list		ill_lock		ill_lock
  * ill_refcnt			ill_lock		ill_lock
- * ill_cnt_ire			ill_lock		ill_lock
+ * ill_ire_cnt			ill_lock		ill_lock
  * ill_cv			ill_lock		ill_lock
  * ill_ilm_walker_cnt		ill_lock		ill_lock
- * ill_cnt_nce			ill_lock		ill_lock
- * ill_cnt_ilm			ill_lock		ill_lock
+ * ill_nce_cnt			ill_lock		ill_lock
+ * ill_ilm_cnt			ill_lock		ill_lock
  * ill_trace			ill_lock		ill_lock
  * ill_usesrc_grp_next		ill_g_usesrc_lock	ill_g_usesrc_lock
  * ill_dhcpinit			atomics			atomics
diff --git a/usr/src/uts/common/inet/ip/ip6_ire.c b/usr/src/uts/common/inet/ip/ip6_ire.c
index 7d5ca1f6fe..7f7c889412 100644
--- a/usr/src/uts/common/inet/ip/ip6_ire.c
+++ b/usr/src/uts/common/inet/ip/ip6_ire.c
@@ -852,12 +852,12 @@ failed:
 	if (ire->ire_ipif != NULL) {
 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ire->ire_ipif,
 		    (char *), "ire", (void *), ire);
-		ire->ire_ipif->ipif_cnt_ire++;
+		ire->ire_ipif->ipif_ire_cnt++;
 		if (ire->ire_stq != NULL) {
 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
 			DTRACE_PROBE3(ill__incr__cnt, (ill_t *), stq_ill,
 			    (char *), "ire", (void *), ire);
-			stq_ill->ill_cnt_ire++;
+			stq_ill->ill_ire_cnt++;
 		}
 	} else {
 		ASSERT(ire->ire_stq == NULL);
diff --git a/usr/src/uts/common/inet/ip/ip_if.c b/usr/src/uts/common/inet/ip/ip_if.c
index 06bba1a0ba..1019764bc7 100644
--- a/usr/src/uts/common/inet/ip/ip_if.c
+++ b/usr/src/uts/common/inet/ip/ip_if.c
@@ -6371,7 +6371,7 @@ ipif_ill_refrele_tail(ill_t *ill)
 	    ipsq->ipsq_pending_ipif != NULL);
 	/*
 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
-	 * Last ipif going down needs to down the ill, so ill_cnt_ire must
+	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
 	 * be zero for restarting an ioctl that ends up downing the ill.
 	 */
 	ipif = ipsq->ipsq_pending_ipif;
@@ -15325,7 +15325,7 @@ redo:
 		new_lb_ire->ire_bucket->irb_ire_cnt++;
 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), new_lb_ire->ire_ipif,
 		    (char *), "ire", (void *), new_lb_ire);
-		new_lb_ire->ire_ipif->ipif_cnt_ire++;
+		new_lb_ire->ire_ipif->ipif_ire_cnt++;
 
 		if (clear_ire_stq != NULL) {
 			/* Set the max_frag before adding the ire */
@@ -15351,11 +15351,11 @@ redo:
 			DTRACE_PROBE3(ipif__incr__cnt,
 			    (ipif_t *), new_nlb_ire->ire_ipif,
 			    (char *), "ire", (void *), new_nlb_ire);
-			new_nlb_ire->ire_ipif->ipif_cnt_ire++;
+			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
 			DTRACE_PROBE3(ill__incr__cnt,
 			    (ill_t *), new_nlb_ire->ire_stq->q_ptr,
 			    (char *), "ire", (void *), new_nlb_ire);
-			((ill_t *)(new_nlb_ire->ire_stq->q_ptr))->ill_cnt_ire++;
+			((ill_t *)(new_nlb_ire->ire_stq->q_ptr))->ill_ire_cnt++;
 		}
 	}
 	rw_exit(&irb->irb_lock);
@@ -18437,14 +18437,14 @@ conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
  *
  * The following members in ipif_t track references to the ipif.
  *	int     ipif_refcnt;    Active reference count
- *	uint_t  ipif_cnt_ire;   Number of ire's referencing this ipif
- *	uint_t  ipif_cnt_ilm;   Number of ilms's references this ipif.
+ *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
+ *	uint_t  ipif_ilm_cnt;   Number of ilms's references this ipif.
  *
  * The following members in ill_t track references to the ill.
  *	int             ill_refcnt;     active refcnt
- *	uint_t          ill_cnt_ire;	Number of ires referencing ill
- *	uint_t          ill_cnt_nce;	Number of nces referencing ill
- *	uint_t          ill_cnt_ilm;	Number of ilms referencing ill
+ *	uint_t          ill_ire_cnt;	Number of ires referencing ill
+ *	uint_t          ill_nce_cnt;	Number of nces referencing ill
+ *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
  *
  * Reference to an ipif or ill can be obtained in any of the following ways.
  *
@@ -18458,14 +18458,14 @@ conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
  * references to the ipif / ill. Pointers from other structures do not
  * count towards this reference count.
  *
- * ipif_cnt_ire/ill_cnt_ire is the number of ire's
+ * ipif_ire_cnt/ill_ire_cnt is the number of ire's
  * associated with the ipif/ill. This is incremented whenever a new
  * ire is created referencing the ipif/ill. This is done atomically inside
  * ire_add_v[46] where the ire is actually added to the ire hash table.
  * The count is decremented in ire_inactive where the ire is destroyed.
  *
  * nce's reference ill's thru nce_ill and the count of nce's associated with
- * an ill is recorded in ill_cnt_nce. This is incremented atomically in
+ * an ill is recorded in ill_nce_cnt. This is incremented atomically in
  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
  * table. Similarly it is decremented in ndp_inactive() where the nce
  * is destroyed.
@@ -18505,7 +18505,7 @@ conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
  * zero and the ipif will quiesce, once all threads that currently hold a
  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
  * ipif_refcount has dropped to zero and all ire's associated with this ipif
- * have also been ire_inactive'd. i.e. when ipif_cnt_{ire, ill} and
+ * have also been ire_inactive'd. i.e. when ipif_{ire, ill}_cnt and
  * ipif_refcnt both drop to zero. See also: comments above IPIF_DOWN_OK()
  * in ip.h
  *
diff --git a/usr/src/uts/common/inet/ip/ip_ire.c b/usr/src/uts/common/inet/ip/ip_ire.c
index 7a644a3a3c..86f6abd424 100644
--- a/usr/src/uts/common/inet/ip/ip_ire.c
+++ b/usr/src/uts/common/inet/ip/ip_ire.c
@@ -3155,12 +3155,12 @@ insert_ire:
 	if (ire->ire_ipif != NULL) {
 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ire->ire_ipif,
 		    (char *), "ire", (void *), ire);
-		ire->ire_ipif->ipif_cnt_ire++;
+		ire->ire_ipif->ipif_ire_cnt++;
 		if (ire->ire_stq != NULL) {
 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
 			DTRACE_PROBE3(ill__incr__cnt, (ill_t *), stq_ill,
 			    (char *), "ire", (void *), ire);
-			stq_ill->ill_cnt_ire++;
+			stq_ill->ill_ire_cnt++;
 		}
 	} else {
 		ASSERT(ire->ire_stq == NULL);
@@ -3610,16 +3610,16 @@ ire_inactive(ire_t *ire)
 	}
 
 	/*
-	 * ipif_cnt_ire on this ipif goes down by 1. If the ire_stq is
+	 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is
 	 * non-null ill_ire_count also goes down by 1.
 	 *
 	 * The ipif that is associated with an ire is ire->ire_ipif and
-	 * hence when the ire->ire_ipif->ipif_cnt_ire drops to zero we call
+	 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call
 	 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as
 	 * ire->ire_ipif->ipif_ill. So nothing more needs to be done. Only
 	 * in the case of IRE_CACHES when IPMP is used, stq_ill can be
 	 * different. If this is different from ire->ire_ipif->ipif_ill and
-	 * if the ill_cnt_ire on the stq_ill also has dropped to zero, we call
+	 * if the ill_ire_cnt on the stq_ill also has dropped to zero, we call
 	 * ipif_ill_refrele_tail on the stq_ill.
 	 */
 
@@ -3629,17 +3629,17 @@ ire_inactive(ire_t *ire)
 	if (stq_ill == NULL || stq_ill == ill) {
 		/* Optimize the most common case */
 		mutex_enter(&ill->ill_lock);
-		ASSERT(ipif->ipif_cnt_ire != 0);
+		ASSERT(ipif->ipif_ire_cnt != 0);
 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif,
 		    (char *), "ire", (void *), ire);
-		ipif->ipif_cnt_ire--;
+		ipif->ipif_ire_cnt--;
 		if (IPIF_DOWN_OK(ipif))
 			need_wakeup = B_TRUE;
 		if (stq_ill != NULL) {
-			ASSERT(stq_ill->ill_cnt_ire != 0);
+			ASSERT(stq_ill->ill_ire_cnt != 0);
 			DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill,
 			    (char *), "ire", (void *), ire);
-			stq_ill->ill_cnt_ire--;
+			stq_ill->ill_ire_cnt--;
 			if (ILL_DOWN_OK(stq_ill))
 				need_wakeup = B_TRUE;
 		}
@@ -3657,10 +3657,10 @@ ire_inactive(ire_t *ire)
 		 * a time.
 		 */
 		mutex_enter(&ill->ill_lock);
-		ASSERT(ipif->ipif_cnt_ire != 0);
+		ASSERT(ipif->ipif_ire_cnt != 0);
 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif,
 		    (char *), "ire", (void *), ire);
-		ipif->ipif_cnt_ire--;
+		ipif->ipif_ire_cnt--;
 		if (IPIF_DOWN_OK(ipif)) {
 			/* Drops the lock */
 			ipif_ill_refrele_tail(ill);
@@ -3669,10 +3669,10 @@ ire_inactive(ire_t *ire)
 		}
 		if (stq_ill != NULL) {
 			mutex_enter(&stq_ill->ill_lock);
-			ASSERT(stq_ill->ill_cnt_ire != 0);
+			ASSERT(stq_ill->ill_ire_cnt != 0);
 			DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill,
 			    (char *), "ire", (void *), ire);
-			stq_ill->ill_cnt_ire--;
+			stq_ill->ill_ire_cnt--;
 			if (ILL_DOWN_OK(stq_ill)) {
 				/* Drops the ill lock */
 				ipif_ill_refrele_tail(stq_ill);
diff --git a/usr/src/uts/common/inet/ip/ip_multi.c b/usr/src/uts/common/inet/ip/ip_multi.c
index 6184e6a000..b5c28baaad 100644
--- a/usr/src/uts/common/inet/ip/ip_multi.c
+++ b/usr/src/uts/common/inet/ip/ip_multi.c
@@ -175,6 +175,7 @@ conn_ilg_reap(conn_t *connp)
 {
 	int	to;
 	int	from;
+	ilg_t	*ilg;
 
 	ASSERT(MUTEX_HELD(&connp->conn_lock));
 
@@ -182,7 +183,9 @@ conn_ilg_reap(conn_t *connp)
 	from = 0;
 	while (from < connp->conn_ilg_inuse) {
 		if (connp->conn_ilg[from].ilg_flags & ILG_DELETED) {
-			FREE_SLIST(connp->conn_ilg[from].ilg_filter);
+			ilg = &connp->conn_ilg[from];
+			FREE_SLIST(ilg->ilg_filter);
+			ilg->ilg_flags &= ~ILG_DELETED;
 			from++;
 			continue;
 		}
@@ -217,7 +220,7 @@ conn_ilg_reap(conn_t *connp)
 static ilg_t *
 conn_ilg_alloc(conn_t *connp)
 {
-	ilg_t *new;
+	ilg_t *new, *ret;
 	int curcnt;
 
 	ASSERT(MUTEX_HELD(&connp->conn_lock));
@@ -231,6 +234,17 @@ conn_ilg_alloc(conn_t *connp)
 		connp->conn_ilg_inuse = 0;
 	}
 	if (connp->conn_ilg_inuse == connp->conn_ilg_allocated) {
+		if (connp->conn_ilg_walker_cnt != 0) {
+			/*
+			 * XXX We cannot grow the array at this point
+			 * because a list walker could be in progress, and
+			 * we cannot wipe out the existing array until the
+			 * walker is done. Just return NULL for now.
+			 * ilg_delete_all() will have to be changed when
+			 * this logic is changed.
+			 */
+			return (NULL);
+		}
 		curcnt = connp->conn_ilg_allocated;
 		new = GETSTRUCT(ilg_t, curcnt + ILG_ALLOC_CHUNK);
 		if (new == NULL)
@@ -241,7 +255,10 @@ conn_ilg_alloc(conn_t *connp)
 		connp->conn_ilg_allocated += ILG_ALLOC_CHUNK;
 	}
 
-	return (&connp->conn_ilg[connp->conn_ilg_inuse++]);
+	ret = &connp->conn_ilg[connp->conn_ilg_inuse++];
+	ASSERT((ret->ilg_flags & ILG_DELETED) == 0);
+	bzero(ret, sizeof (*ret));
+	return (ret);
 }
 
 typedef struct ilm_fbld_s {
@@ -1660,14 +1677,14 @@ ilm_add_v6(ipif_t *ipif, const in6_addr_t *v6group, ilg_stat_t ilgstat,
 		ilm->ilm_ipif = NULL;
 		DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ill,
 		    (char *), "ilm", (void *), ilm);
-		ill->ill_cnt_ilm++;
+		ill->ill_ilm_cnt++;
 	} else {
 		ASSERT(ilm->ilm_zoneid == ipif->ipif_zoneid);
 		ilm->ilm_ipif = ipif;
 		ilm->ilm_ill = NULL;
 		DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ipif,
 		    (char *), "ilm", (void *), ilm);
-		ipif->ipif_cnt_ilm++;
+		ipif->ipif_ilm_cnt++;
 	}
 	ASSERT(ill->ill_ipst);
 	ilm->ilm_ipst = ill->ill_ipst;	/* No netstack_hold */
@@ -1758,7 +1775,7 @@ ilm_walker_cleanup(ill_t *ill)
 				DTRACE_PROBE3(ipif__decr__cnt,
 				    (ipif_t *), ilm->ilm_ipif,
 				    (char *), "ilm", (void *), ilm);
-				ilm->ilm_ipif->ipif_cnt_ilm--;
+				ilm->ilm_ipif->ipif_ilm_cnt--;
 				if (IPIF_FREE_OK(ilm->ilm_ipif))
 					need_wakeup = B_TRUE;
 			} else {
@@ -1769,7 +1786,7 @@ ilm_walker_cleanup(ill_t *ill)
 				DTRACE_PROBE3(ill__decr__cnt,
 				    (ill_t *), ill,
 				    (char *), "ilm", (void *), ilm);
-				ill->ill_cnt_ilm--;
+				ill->ill_ilm_cnt--;
 				if (ILL_FREE_OK(ill))
 					need_wakeup = B_TRUE;
 			}
@@ -1832,13 +1849,13 @@ ilm_delete(ilm_t *ilm)
 	if (ilm->ilm_ipif != NULL) {
 		DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ilm->ilm_ipif,
 		    (char *), "ilm", (void *), ilm);
-		ilm->ilm_ipif->ipif_cnt_ilm--;
+		ilm->ilm_ipif->ipif_ilm_cnt--;
 		if (IPIF_FREE_OK(ilm->ilm_ipif))
 			need_wakeup = B_TRUE;
 	} else {
 		DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill,
 		    (char *), "ilm", (void *), ilm);
-		ill->ill_cnt_ilm--;
+		ill->ill_ilm_cnt--;
 		if (ILL_FREE_OK(ill))
 			need_wakeup = B_TRUE;
 	}
@@ -3515,9 +3532,9 @@ ilg_lookup_ill_withsrc(conn_t *connp, ipaddr_t group, ipaddr_t src, ill_t *ill)
 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
 
 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
-		/* ilg_ipif is NULL for v6; skip them */
 		ilg = &connp->conn_ilg[i];
-		if ((ipif = ilg->ilg_ipif) == NULL)
+		if ((ipif = ilg->ilg_ipif) == NULL ||
+		    (ilg->ilg_flags & ILG_DELETED) != 0)
 			continue;
 		ASSERT(ilg->ilg_ill == NULL);
 		ilg_ill = ipif->ipif_ill;
@@ -3570,7 +3587,8 @@ ilg_lookup_ill_withsrc_v6(conn_t *connp, const in6_addr_t *v6group,
 
 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
 		ilg = &connp->conn_ilg[i];
-		if ((ilg_ill = ilg->ilg_ill) == NULL)
+		if ((ilg_ill = ilg->ilg_ill) == NULL ||
+		    (ilg->ilg_flags & ILG_DELETED) != 0)
 			continue;
 		ASSERT(ilg->ilg_ipif == NULL);
 		ASSERT(ilg_ill->ill_isv6);
@@ -3620,8 +3638,8 @@ ilg_lookup_ill_index_v6(conn_t *connp, const in6_addr_t *v6group, int ifindex)
 	ASSERT(MUTEX_HELD(&connp->conn_lock));
 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
 		ilg = &connp->conn_ilg[i];
-		/* ilg_ill is NULL for V4. Skip them */
-		if (ilg->ilg_ill == NULL)
+		if (ilg->ilg_ill == NULL ||
+		    (ilg->ilg_flags & ILG_DELETED) != 0)
 			continue;
 		/* ilg_ipif is NULL for V6 */
 		ASSERT(ilg->ilg_ipif == NULL);
@@ -3648,7 +3666,8 @@ ilg_lookup_ill_v6(conn_t *connp, const in6_addr_t *v6group, ill_t *ill)
 
 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
 		ilg = &connp->conn_ilg[i];
-		if ((mem_ill = ilg->ilg_ill) == NULL)
+		if ((mem_ill = ilg->ilg_ill) == NULL ||
+		    (ilg->ilg_flags & ILG_DELETED) != 0)
 			continue;
 		ASSERT(ilg->ilg_ipif == NULL);
 		ASSERT(mem_ill->ill_isv6);
@@ -3667,6 +3686,7 @@ ilg_lookup_ipif(conn_t *connp, ipaddr_t group, ipif_t *ipif)
 {
 	in6_addr_t v6group;
 	int	i;
+	ilg_t	*ilg;
 
 	ASSERT(MUTEX_HELD(&connp->conn_lock));
 	ASSERT(!ipif->ipif_ill->ill_isv6);
@@ -3677,10 +3697,11 @@ ilg_lookup_ipif(conn_t *connp, ipaddr_t group, ipif_t *ipif)
 		IN6_IPADDR_TO_V4MAPPED(group, &v6group);
 
 	for (i = 0; i < connp->conn_ilg_inuse; i++) {
-		if (IN6_ARE_ADDR_EQUAL(&connp->conn_ilg[i].ilg_v6group,
-		    &v6group) &&
-		    connp->conn_ilg[i].ilg_ipif == ipif)
-			return (&connp->conn_ilg[i]);
+		ilg = &connp->conn_ilg[i];
+		if ((ilg->ilg_flags & ILG_DELETED) == 0 &&
+		    IN6_ARE_ADDR_EQUAL(&ilg->ilg_v6group, &v6group) &&
+		    ilg->ilg_ipif == ipif)
+			return (ilg);
 	}
 	return (NULL);
 }
diff --git a/usr/src/uts/common/inet/ip/ip_ndp.c b/usr/src/uts/common/inet/ip/ip_ndp.c
index 4023e5259c..fc55ba4b9f 100644
--- a/usr/src/uts/common/inet/ip/ip_ndp.c
+++ b/usr/src/uts/common/inet/ip/ip_ndp.c
@@ -255,7 +255,7 @@ ndp_add_v6(ill_t *ill, uchar_t *hw_addr, const in6_addr_t *addr,
 	/* Bump up the number of nce's referencing this ill */
 	DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ill,
 	    (char *), "nce", (void *), nce);
-	ill->ill_cnt_nce++;
+	ill->ill_nce_cnt++;
 	mutex_exit(&ill->ill_lock);
 
 	err = 0;
@@ -496,7 +496,7 @@ ndp_inactive(nce_t *nce)
 	mutex_enter(&ill->ill_lock);
 	DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill,
 	    (char *), "nce", (void *), nce);
-	ill->ill_cnt_nce--;
+	ill->ill_nce_cnt--;
 	/*
 	 * If the number of nce's associated with this ill have dropped
 	 * to zero, check whether we need to restart any operation that
@@ -3630,7 +3630,7 @@ ndp_add_v4(ill_t *ill, const in_addr_t *addr, uint16_t flags,
 	/* Bump up the number of nce's referencing this ill */
 	DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ill,
 	    (char *), "nce", (void *), nce);
-	ill->ill_cnt_nce++;
+	ill->ill_nce_cnt++;
 	mutex_exit(&ill->ill_lock);
 	DTRACE_PROBE1(ndp__add__v4, nce_t *, nce);
 	return (0);