[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Jun 2012 20:01:38 +0400
From: Vladimir Davydov <VDavydov@...allels.com>
To: Eric Dumazet <eric.dumazet@...il.com>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: Possible deadlock in ipv6?
On Jun 6, 2012, at 7:58 PM, Eric Dumazet wrote:
> On Wed, 2012-06-06 at 17:53 +0200, Eric Dumazet wrote:
>> On Wed, 2012-06-06 at 18:49 +0400, Vladimir Davydov wrote:
>>> I'm not familiar with the linux net subsystem, so I would appreciate if
>>> someone could clarify if the following call chain is possible:
>>>
>>> addrconf_ifdown() calls neigh_ifdown(nd_tbl) which locks nd_tbl.lock for
>>> writing and calls
>>>
>>> pneigh_ifdown
>>> pndisc_destructor
>>> ipv6_dev_mc_dec
>>> __ipv6_dev_mc_dec
>>> igmp6_group_dropped
>>> igmp6_leave_group
>>> igmp6_send
>>> icmp6_dst_alloc
>>> ip6_neigh_lookup
>>> neigh_create
>>>
>>> and neigh_create() locks nd_tbl.lock for writing again resulting in a
>>> deadlock.
>>
>> It seems a deadlock is possible indeed, good catch !
>>
>>
>
> And it seems this neigh_down() can be removed, its called later
> (after dev->ip6_ptr is cleared)
>
BTW, commit d1ed113f1669390da9898da3beddcc058d938587 did exactly the same, but it was reverted along with a bundle of other commits by 73a8bd74e2618990dbb218c3d82f53e60acd9af0.
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 8f6411c..62c4c00 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -2750,7 +2750,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
> ASSERT_RTNL();
>
> rt6_ifdown(net, dev);
> - neigh_ifdown(&nd_tbl, dev);
>
> idev = __in6_dev_get(dev);
> if (idev == NULL)
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists