[PATCH 2.6 2/5]: refcount qdisc->dev

[PATCH 2.6 2/5]: refcount qdisc->dev

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 242 bytes --]

This patch adds refcounting for qdisc->dev to avoid accessing freed memory
from the __qdisc_destroy rcu-callback when the device is unregistered. 
Without
refcounting netdev_wait_allrefs could free the device before __qdisc_destroy
is done.


[-- Attachment #2: 02-refcount-qdisc-dev.diff --]
[-- Type: text/x-patch, Size: 1522 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/08/02 23:50:01+02:00 kaber@coreworks.de 
#   [PKT_SCHED: Refcount qdisc->dev for __qdisc_destroy rcu-callback
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/sched/sch_generic.c
#   2004/08/02 23:49:40+02:00 kaber@coreworks.de +3 -0
#   [PKT_SCHED: Refcount qdisc->dev for __qdisc_destroy rcu-callback
# 
# net/sched/sch_api.c
#   2004/08/02 23:49:40+02:00 kaber@coreworks.de +1 -0
#   [PKT_SCHED: Refcount qdisc->dev for __qdisc_destroy rcu-callback
# 
diff -Nru a/net/sched/sch_api.c b/net/sched/sch_api.c
--- a/net/sched/sch_api.c	2004-08-03 01:10:18 +02:00
+++ b/net/sched/sch_api.c	2004-08-03 01:10:18 +02:00
@@ -430,6 +430,7 @@
 	sch->enqueue = ops->enqueue;
 	sch->dequeue = ops->dequeue;
 	sch->dev = dev;
+	dev_hold(dev);
 	atomic_set(&sch->refcnt, 1);
 	sch->stats_lock = &dev->queue_lock;
 	if (handle == 0) {
diff -Nru a/net/sched/sch_generic.c b/net/sched/sch_generic.c
--- a/net/sched/sch_generic.c	2004-08-03 01:10:18 +02:00
+++ b/net/sched/sch_generic.c	2004-08-03 01:10:18 +02:00
@@ -399,6 +399,7 @@
 	sch->enqueue = ops->enqueue;
 	sch->dequeue = ops->dequeue;
 	sch->dev = dev;
+	dev_hold(dev);
 	sch->stats_lock = &dev->queue_lock;
 	atomic_set(&sch->refcnt, 1);
 	/* enqueue is accessed locklessly - make sure it's visible
@@ -440,6 +441,8 @@
 	write_unlock(&qdisc_tree_lock);
 	module_put(ops->owner);
 
+	if (qdisc->dev)
+		dev_put(qdisc->dev);
 	if (!(qdisc->flags&TCQ_F_BUILTIN))
 		kfree(qdisc);
 }

Re: [PATCH 2.6 2/5]: refcount qdisc->dev

[David S. Miller]

On Tue, 03 Aug 2004 17:22:36 +0200
Patrick McHardy <kaber@trash.net> wrote:

> This patch adds refcounting for qdisc->dev to avoid accessing freed memory
> from the __qdisc_destroy rcu-callback when the device is unregistered. 
> Without
> refcounting netdev_wait_allrefs could free the device before __qdisc_destroy
> is done.

We do need this.  Applied, thanks Patrick.