Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler()

From: Gao feng <[email-masked]>
Date: Thu, 05 Dec 2013 08:32:00 +0800

On 12/04/2013 11:24 PM, Eric Dumazet wrote:
> On Wed, 2013-12-04 at 17:16 +0800, Ding Tianhong wrote:
>>>> 						base->running_timer = neigh->timer;
>>>> 						neigh_timer_handler() => at this time, refcnt is 2;
>>>>
>>>> user->	neigh_changeaddr()
>>>> 	neigh_flush_dev();
>>>> 	neigh_del_imer, refcnt dec to 1;
>>>
>>> Nope : del_timer() would return 0 here, so we do not decrement refcnt.
>>>
>>
>> The first call for del_timer() will return 1, because the timer->entry.next is not NULL,
>> then in the neigh_destroy, the del_timer() again will return 0 because timer->entry.next is NULL. 
> 
> Again no. You are very mistaken.
> 
> del_timer() return code is not a hint. Its a precise meaning.
> 
> It cannot return 1 if the timer function is running or is about to run.
> 
> If you believe there is  bug in del_timer(), fix it ;)
> 
> 

Yes, you are right, __run_timers did this job.
So We still don't know what's the root reason.