Commit 4a32b9e7 authored by Krishna Kumar's avatar Krishna Kumar Committed by David S. Miller

[IPV6]: Fix hangs during interface down caused by ipv6_del_addr().

While using PRIVACY extensions, I sometimes get a hang when I remove the
interface. But I can reproduce this every time using the test script at
the end of the mail (hang depends on the order of address deletion).

The bug is in ipv6_del_addr() where if a temp address is being deleted, it
does an __in6_ifa_put() of the main address from which it was derived
(basically the autoconf prefix address). So if the main address was
deleted first, it's ifp ref count would be 1 and it would 'wait' to be
freed till it's temp address was freed first. When the temp address is
deleted, the __put() routine drops the main address's ifp ref count to 0,
but not free it. unregister_netdevice() hangs giving message that ref
count is 1. Fix tested overnight.

Also, the code at the top of the routine is unnecessary, the same is being
done when the address is found a little later in that routine.
parent 94093659
...@@ -571,15 +571,6 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp) ...@@ -571,15 +571,6 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
ifp->dead = 1; ifp->dead = 1;
#ifdef CONFIG_IPV6_PRIVACY
spin_lock_bh(&ifp->lock);
if (ifp->ifpub) {
__in6_ifa_put(ifp->ifpub);
ifp->ifpub = NULL;
}
spin_unlock_bh(&ifp->lock);
#endif
write_lock_bh(&addrconf_hash_lock); write_lock_bh(&addrconf_hash_lock);
for (ifap = &inet6_addr_lst[hash]; (ifa=*ifap) != NULL; for (ifap = &inet6_addr_lst[hash]; (ifa=*ifap) != NULL;
ifap = &ifa->lst_next) { ifap = &ifa->lst_next) {
...@@ -600,7 +591,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp) ...@@ -600,7 +591,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
if (ifa == ifp) { if (ifa == ifp) {
*ifap = ifa->tmp_next; *ifap = ifa->tmp_next;
if (ifp->ifpub) { if (ifp->ifpub) {
__in6_ifa_put(ifp->ifpub); in6_ifa_put(ifp->ifpub);
ifp->ifpub = NULL; ifp->ifpub = NULL;
} }
__in6_ifa_put(ifp); __in6_ifa_put(ifp);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment