All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/2] ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put
@ 2013-09-29 20:39 Salam Noureddine
  2013-10-01  5:30 ` David Miller
  0 siblings, 1 reply; 2+ messages in thread
From: Salam Noureddine @ 2013-09-29 20:39 UTC (permalink / raw)
  To: David S. Miller, Alexey Kuznetsov, James Morris,
	Hideaki YOSHIFUJI, Patrick McHardy, netdev
  Cc: Salam Noureddine

It is possible for the timer handlers to run after the call to
ip_mc_down so use in_dev_put instead of __in_dev_put in the handler
function in order to do proper cleanup when the refcnt reaches 0.
Otherwise, the refcnt can reach zero without the in_device being
destroyed and we end up leaking a reference to the net_device and
see messages like the following,

unregister_netdevice: waiting for eth0 to become free. Usage count = 1

Tested on linux-3.4.43.

Signed-off-by: Salam Noureddine <noureddine@aristanetworks.com>
---
 net/ipv4/igmp.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index dace87f..7defdc9 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -736,7 +736,7 @@ static void igmp_gq_timer_expire(unsigned long data)
 
 	in_dev->mr_gq_running = 0;
 	igmpv3_send_report(in_dev, NULL);
-	__in_dev_put(in_dev);
+	in_dev_put(in_dev);
 }
 
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -749,7 +749,7 @@ static void igmp_ifc_timer_expire(unsigned long data)
 		igmp_ifc_start_timer(in_dev,
 				     unsolicited_report_interval(in_dev));
 	}
-	__in_dev_put(in_dev);
+	in_dev_put(in_dev);
 }
 
 static void igmp_ifc_event(struct in_device *in_dev)
-- 
1.7.4.4

^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH 1/2] ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put
  2013-09-29 20:39 [PATCH 1/2] ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put Salam Noureddine
@ 2013-10-01  5:30 ` David Miller
  0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-10-01  5:30 UTC (permalink / raw)
  To: noureddine; +Cc: kuznet, jmorris, yoshfuji, kaber, netdev

From: Salam Noureddine <noureddine@aristanetworks.com>
Date: Sun, 29 Sep 2013 13:39:42 -0700

> It is possible for the timer handlers to run after the call to
> ip_mc_down so use in_dev_put instead of __in_dev_put in the handler
> function in order to do proper cleanup when the refcnt reaches 0.
> Otherwise, the refcnt can reach zero without the in_device being
> destroyed and we end up leaking a reference to the net_device and
> see messages like the following,
> 
> unregister_netdevice: waiting for eth0 to become free. Usage count = 1
> 
> Tested on linux-3.4.43.
> 
> Signed-off-by: Salam Noureddine <noureddine@aristanetworks.com>

Applied and queued up for -stable.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2013-10-01  5:23 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-09-29 20:39 [PATCH 1/2] ipv4 igmp: use in_dev_put in timer handlers instead of __in_dev_put Salam Noureddine
2013-10-01  5:30 ` David Miller

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.