[PATCH] Unmatched decrementing of net device reference count

[Glauber de Oliveira Costa <gcosta@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 460 bytes --]

Hello,

This bug was found when heavy stressing the netfront 
attach/detach mechanism with the following script:
 
   for i in $(seq 200); 
   do 
     xm network-attach <domid>;  
     xm network-detach <domid> $i;
   done

Guest kernel shows the following messages:

unregister_netdevice: waiting for eth1 to become free. Usage count = -1

After this patch, it ran okay in multiple iterations

-- 
Glauber de Oliveira Costa
Red Hat Inc.
"Free as in Freedom"

[-- Attachment #2: xen-netfront-refcnt.patch --]
[-- Type: text/plain, Size: 1505 bytes --]

# HG changeset patch
# User gcosta@redhat.com
# Date 1166523892 7200
# Node ID 815165a1368b7e8292a2ef390b43a1cde7f0b1b0
# Parent  b3cd9c4ac0561a89e13c7c74a9dc990d102a6080
[LINUX] Avoid reference counter going below zero.

After calling unregister_netdev, the device may be freed by
the underlying layer. There can be situations in which the free'd
address was already taken by another netdev, and between the two
events, a linkwatch event was fired, putting the device in the
linkwatch event list.

When the network device layer goes through its event list, it finds
the older reference, and calls dev_put() one extra time. Generally
speaking, it is not safe to call unregister_netdev when we still plan
work to be done, so we should call it after netif_disconnect_backend().

Signed-off-by: Glauber de Oliveira Costa <gcosta@redhat.com>

diff -r b3cd9c4ac056 -r 815165a1368b linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Tue Dec 19 10:53:17 2006 +0000
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Tue Dec 19 08:24:52 2006 -0200
@@ -2022,6 +2022,7 @@ static int __devexit netfront_remove(str
 	DPRINTK("%s\n", dev->nodename);
 
 	netif_disconnect_backend(info);
+	unregister_netdev(info->netdev);
 	free_netdev(info->netdev);
 
 	return 0;
@@ -2055,7 +2056,6 @@ static void close_netdev(struct netfront
 	del_timer_sync(&info->rx_refill_timer);
 
 	xennet_sysfs_delif(info->netdev);
-	unregister_netdev(info->netdev);
 }
 
 

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel