Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler()

From: Ding Tianhong <[email-masked]>
Date: Thu, 5 Dec 2013 11:17:58 +0800

On 2013/12/5 8:32, Gao feng wrote:
> On 12/04/2013 11:24 PM, Eric Dumazet wrote:
>> On Wed, 2013-12-04 at 17:16 +0800, Ding Tianhong wrote:
>>>>> 						base->running_timer = neigh->timer;
>>>>> 						neigh_timer_handler() => at this time, refcnt is 2;
>>>>>
>>>>> user->	neigh_changeaddr()
>>>>> 	neigh_flush_dev();
>>>>> 	neigh_del_imer, refcnt dec to 1;
>>>>
>>>> Nope : del_timer() would return 0 here, so we do not decrement refcnt.
>>>>
>>>
>>> The first call for del_timer() will return 1, because the timer->entry.next is not NULL,
>>> then in the neigh_destroy, the del_timer() again will return 0 because timer->entry.next is NULL. 
>>
>> Again no. You are very mistaken.
>>
>> del_timer() return code is not a hint. Its a precise meaning.
>>
>> It cannot return 1 if the timer function is running or is about to run.
>>
>> If you believe there is  bug in del_timer(), fix it ;)
>>
>>
> 
> Yes, you are right, __run_timers did this job.
> So We still don't know what's the root reason.
> 
Yes, I miss it, the running timer is detached from the list, thanks for all above.

Regards
Ding