[Xen-devel] [PATCH] Unmatched decrementing of net device reference count

[Glauber de Oliveira Costa <gcosta@xxxxxxxxxx>]

Hello,

This bug was found when heavy stressing the netfront 
attach/detach mechanism with the following script:
 
   for i in $(seq 200); 
   do 
     xm network-attach <domid>;  
     xm network-detach <domid> $i;
   done

Guest kernel shows the following messages:

unregister_netdevice: waiting for eth1 to become free. Usage count = -1

After this patch, it ran okay in multiple iterations

-- 
Glauber de Oliveira Costa
Red Hat Inc.
"Free as in Freedom"

# HG changeset patch
# User gcosta@xxxxxxxxxx
# Date 1166523892 7200
# Node ID 815165a1368b7e8292a2ef390b43a1cde7f0b1b0
# Parent  b3cd9c4ac0561a89e13c7c74a9dc990d102a6080
[LINUX] Avoid reference counter going below zero.

After calling unregister_netdev, the device may be freed by
the underlying layer. There can be situations in which the free'd
address was already taken by another netdev, and between the two
events, a linkwatch event was fired, putting the device in the
linkwatch event list.

When the network device layer goes through its event list, it finds
the older reference, and calls dev_put() one extra time. Generally
speaking, it is not safe to call unregister_netdev when we still plan
work to be done, so we should call it after netif_disconnect_backend().

Signed-off-by: Glauber de Oliveira Costa <gcosta@xxxxxxxxxx>

diff -r b3cd9c4ac056 -r 815165a1368b 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Tue Dec 19 
10:53:17 2006 +0000
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Tue Dec 19 
08:24:52 2006 -0200
@@ -2022,6 +2022,7 @@ static int __devexit netfront_remove(str
        DPRINTK("%s\n", dev->nodename);
 
        netif_disconnect_backend(info);
+       unregister_netdev(info->netdev);
        free_netdev(info->netdev);
 
        return 0;
@@ -2055,7 +2056,6 @@ static void close_netdev(struct netfront
        del_timer_sync(&info->rx_refill_timer);
 
        xennet_sysfs_delif(info->netdev);
-       unregister_netdev(info->netdev);
 }
 
 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel