Subject: [RFC] Handling device free after a packet is passed to the network stack

From: [email-masked]
Date: Fri, 27 Mar 2015 19:57:34 -0000

We have been coming across a couple of scenarios where the device is freed
and the corresponding packets which were already queued up the stack
encounter crashes when they find that contents of skb->dev are no longer
valid.

Specifically, we have observed an instance where a cpu hotplug occurs
along with the network driver module unloading. When the packets are being
queued up the stack using netif_rx_ni from dev_cpu_callback, get_rps_cpus
crashes as it encounters invalid data at skb->dev since it would have been
freed.

We would like to know if the kernel provides some mechanisms to safeguard
against such scenarios.

--
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux
Foundation Collaborative Project