[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 06 Jun 2012 17:58:34 +0200
From: Eric Dumazet <eric.dumazet@...il.com>
To: Vladimir Davydov <vdavydov@...allels.com>
Cc: netdev@...r.kernel.org
Subject: Re: Possible deadlock in ipv6?
On Wed, 2012-06-06 at 17:53 +0200, Eric Dumazet wrote:
> On Wed, 2012-06-06 at 18:49 +0400, Vladimir Davydov wrote:
> > I'm not familiar with the linux net subsystem, so I would appreciate if
> > someone could clarify if the following call chain is possible:
> >
> > addrconf_ifdown() calls neigh_ifdown(nd_tbl) which locks nd_tbl.lock for
> > writing and calls
> >
> > pneigh_ifdown
> > pndisc_destructor
> > ipv6_dev_mc_dec
> > __ipv6_dev_mc_dec
> > igmp6_group_dropped
> > igmp6_leave_group
> > igmp6_send
> > icmp6_dst_alloc
> > ip6_neigh_lookup
> > neigh_create
> >
> > and neigh_create() locks nd_tbl.lock for writing again resulting in a
> > deadlock.
>
> It seems a deadlock is possible indeed, good catch !
>
>
And it seems this neigh_down() can be removed, its called later
(after dev->ip6_ptr is cleared)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8f6411c..62c4c00 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2750,7 +2750,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
ASSERT_RTNL();
rt6_ifdown(net, dev);
- neigh_ifdown(&nd_tbl, dev);
idev = __in6_dev_get(dev);
if (idev == NULL)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists