From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: Re: [PATCH net] dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state Date: Thu, 25 Jan 2018 10:03:47 -0800 Message-ID: <1516903427.3715.52.camel@gmail.com> References: <1516902237-17339-1-git-send-email-alexey.kodanev@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: Eric Dumazet , David Miller , dccp@vger.kernel.org To: Alexey Kodanev , netdev@vger.kernel.org Return-path: Received: from mail-pf0-f193.google.com ([209.85.192.193]:38911 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751243AbeAYSDt (ORCPT ); Thu, 25 Jan 2018 13:03:49 -0500 In-Reply-To: <1516902237-17339-1-git-send-email-alexey.kodanev@oracle.com> Sender: netdev-owner@vger.kernel.org List-ID: On Thu, 2018-01-25 at 20:43 +0300, Alexey Kodanev wrote: > ccid2_hc_tx_rto_expire() timer callback always restarts the timer > again and can run indefinitely (unless it is stopped outside), and > after commit 120e9dabaf55 ("dccp: defer ccid_hc_tx_delete() at > dismantle time"), which moved sk_stop_timer() to sk_destruct(), > this started to happen quite often. The timer prevents releasing > the socket, as a result, sk_destruct() won't be called. > > Found with LTP/dccp_ipsec tests running on the bonding device, > which later couldn't be unloaded after the tests were completed: > > unregister_netdevice: waiting for bond0 to become free. Usage count = 148 > > Fixes: 120e9dabaf55 ("dccp: defer ccid_hc_tx_delete() at dismantle time") > Signed-off-by: Alexey Kodanev > --- I understand your fix, but not why commit 120e9dabaf55 is bug origin. Looks like this always had been buggy : Timer logic should have checked socket state from day 0. I did not move sk_stop_timer() to sk_destruct()