Subject: Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check

From: Stephen Hemminger <[email-masked]>
Date: Tue, 13 Feb 2007 11:55:29 -0800

On Tue, 13 Feb 2007 07:26:51 +0100
Jarek Poplawski <[email-masked]> wrote:

> On Mon, Feb 12, 2007 at 09:47:38AM -0800, Stephen Hemminger wrote:
> > On Mon, 12 Feb 2007 11:28:48 +0100
> > Jarek Poplawski <[email-masked]> wrote:
> > 
> > > Here is my patch proposal for testing.
> > > If it doesn't work - forget about it.
> > > (Prepared with 2.6.20-git6 but could
> > > be applied to 2.6.20 also.)
> > > 
> > > Jarek P.
> > > 
> > > 
> > > dev_hold/dev_put added to prevent dev kfree
> > > during port_carrier_check runnig, while dev
> > > and port are removed.
> > 
> > No, holding the reference just stops the kfree, it doesn't
> > stop the device from being removed from the port.
> 
> But I wrote above it is only to prevent the kfree.
> 
> >        p = dev->br_port;
> >        if (!p)
> >                goto done;
> >        br = p->br;
> 
> Then p is NULL here and we goto done.
> 
> Sorry, but the first version was wrong (incomplete).
> Below I attach a new proposal.
> 
> 
> Signed-off-by: Jarek Poplawski <[email-masked]>

Yes, this looks correct.  If carrier_check is pending the ref count
gets cleared by cancel. If carrier work is waiting for rtnl, then
it cleans itself up.
-- 
Stephen Hemminger <[email-masked]>