bug in /net/core/dev.c

[DJBARROW@de.ibm.com]

[-- Attachment #1: Type: text/plain, Size: 776 bytes --]




Hi,
I found this bug in dev.c

It happens if register_netdevice is called before net_dev_init which can
happen from init functions,
when device drivers are compiled into the kernel.

The dev->refcnt will go up to 2 ( it should be 1) unregister_netdevice will
usually  loop forever
waiting for the refcnt to drop to 1 when an attempt to unregister is done.

The printk in the bootmessages early initialization of device <blah> is
deferred is evidence of this behaviour occuring.

The small patch is below ,hope it is okay for you.

(See attached file: dev.c.2.4.5.patch)

D.J. Barrow Gnu/Linux for S/390 kernel developer
eMail: djbarrow@de.ibm.com,barrow_dj@yahoo.com
Phone: +49-(0)7031-16-2583
IBM Germany Lab, Schönaicherstr. 220, 71032 Böblingen

[-- Attachment #2: dev.c.2.4.5.patch --]
[-- Type: application/octet-stream, Size: 900 bytes --]

--- net/core/dev.old.c	Mon Jun 11 20:00:42 2001
+++ net/core/dev.c	Mon Jun 11 19:51:55 2001
@@ -20,6 +20,9 @@
  *              Pekka Riikonen <priikone@poesidon.pspt.fi>
  *
  *	Changes:
+ *              D.J. Barrow     :       Fixed net_dev_init calling dev_hold & setting
+ *                                      The dev->refcnt to 2 if register_netdev gets 
+ *                                      called first & initialization is deferred.
  *		Alan Cox	:	device private ioctl copies fields back.
  *		Alan Cox	:	Transmit queue code does relevant stunts to
  *					keep the queue safe.
@@ -2733,8 +2736,10 @@
 #endif
 		dev->xmit_lock_owner = -1;
 		dev->iflink = -1;
-		dev_hold(dev);
-
+		/* Can't do dev_hold here in case
+		 *  register_netdev gets called first.
+		 */
+		atomic_set(&dev->refcnt,1);
 		/*
 		 * Allocate name. If the init() fails
 		 * the name will be reissued correctly.