netdev - Re: unregister_netdevice of tap interface blocks for up to 30 secs when ipv6 module loaded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 10 May 2007 13:00:24 -0700 (PDT)
From:	James Lingard <jchl@...stra.com>
To:	netdev@...r.kernel.org
Subject: Re: unregister_netdevice of tap interface blocks for up to 30 secs
 when ipv6 module loaded

On Wed, 9 May 2007, James Lingard wrote:

> If the ipv6 module is loaded, then destroying a tap interface that has 
> recently been disabled will cause close to block (in unregister_netdevice) 
> until precisely 30 seconds have elapsed since the interface was disabled.

I patched netdevice.h to dump a stack trace on calls to dev_hold and 
dev_put, and it appears that this bug is related to IPv6 neighbour 
discovery.  The three references to the interface are finally released 
during a call to ndisc_dst_gc, at the following locations:

   neigh_destroy+0x145/0x183
   dst_destroy+0x56/0xf5
   ndisc_dst_gc+0x39/0x67 [ipv6]
   fib6_run_gc+0x6b/0xbb [ipv6]
   run_timer_softirq+0x102/0x166
   __do_softirq+0x5e/0xca
   do_softirq+0x5f/0xb6

   in6_dev_finish_destroy+0x9f/0xd9 [ipv6]
   ip6_dst_destroy+0x29/0x2b [ipv6]
   dst_destroy+0x6d/0xf5
   ndisc_dst_gc+0x39/0x67 [ipv6]
   fib6_run_gc+0x6b/0xbb [ipv6]
   run_timer_softirq+0x102/0x166
   __do_softirq+0x5e/0xca
   do_softirq+0x5f/0xb6

   dst_destroy+0xb2/0xf5
   ndisc_dst_gc+0x39/0x67 [ipv6]
   fib6_run_gc+0x6b/0xbb [ipv6]
   run_timer_softirq+0x102/0x166
   __do_softirq+0x5e/0xca
   do_softirq+0x5f/0xb6

The complete relevant excerpt from /var/log/messages, showing the times 
and locations of all calls to dev_hold, dev_put and unregister_netdevice 
for this interface (corresponding to the execution of the Python script I 
attached in my previous email), is attached.

James.
View attachment "messages" of type "TEXT/PLAIN" (23427 bytes)