From mboxrd@z Thu Jan 1 00:00:00 1970 From: Glauber de Oliveira Costa Subject: [PATCH] Unmatched decrementing of net device reference count Date: Tue, 19 Dec 2006 13:37:55 -0200 Message-ID: <20061219153755.GD19551@redhat.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="RnlQjJ0d97Da+TV1" Return-path: Content-Disposition: inline List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --RnlQjJ0d97Da+TV1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hello, This bug was found when heavy stressing the netfront attach/detach mechanism with the following script: for i in $(seq 200); do xm network-attach ; xm network-detach $i; done Guest kernel shows the following messages: unregister_netdevice: waiting for eth1 to become free. Usage count = -1 After this patch, it ran okay in multiple iterations -- Glauber de Oliveira Costa Red Hat Inc. "Free as in Freedom" --RnlQjJ0d97Da+TV1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="xen-netfront-refcnt.patch" # HG changeset patch # User gcosta@redhat.com # Date 1166523892 7200 # Node ID 815165a1368b7e8292a2ef390b43a1cde7f0b1b0 # Parent b3cd9c4ac0561a89e13c7c74a9dc990d102a6080 [LINUX] Avoid reference counter going below zero. After calling unregister_netdev, the device may be freed by the underlying layer. There can be situations in which the free'd address was already taken by another netdev, and between the two events, a linkwatch event was fired, putting the device in the linkwatch event list. When the network device layer goes through its event list, it finds the older reference, and calls dev_put() one extra time. Generally speaking, it is not safe to call unregister_netdev when we still plan work to be done, so we should call it after netif_disconnect_backend(). Signed-off-by: Glauber de Oliveira Costa diff -r b3cd9c4ac056 -r 815165a1368b linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c --- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c Tue Dec 19 10:53:17 2006 +0000 +++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c Tue Dec 19 08:24:52 2006 -0200 @@ -2022,6 +2022,7 @@ static int __devexit netfront_remove(str DPRINTK("%s\n", dev->nodename); netif_disconnect_backend(info); + unregister_netdev(info->netdev); free_netdev(info->netdev); return 0; @@ -2055,7 +2056,6 @@ static void close_netdev(struct netfront del_timer_sync(&info->rx_refill_timer); xennet_sysfs_delif(info->netdev); - unregister_netdev(info->netdev); } --RnlQjJ0d97Da+TV1 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --RnlQjJ0d97Da+TV1--