From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarek Poplawski Subject: Re: [PATCH 2.6.19-rc4-git10][PKT_SCHED] sch_htb: INIT_HLIST_NODE after hlist_del() Date: Tue, 7 Nov 2006 07:49:43 +0100 Message-ID: <20061107064943.GA998@ff.dom.local> References: <20061106113353.GA4829@ff.dom.local> <20061106094449.3b8253b9@freekitty> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, "David S\. Miller" Return-path: Received: from mx10.go2.pl ([193.17.41.74]:16594 "EHLO poczta.o2.pl") by vger.kernel.org with ESMTP id S932083AbWKGGnz (ORCPT ); Tue, 7 Nov 2006 01:43:55 -0500 To: Stephen Hemminger Content-Disposition: inline In-Reply-To: <20061106094449.3b8253b9@freekitty> Sender: netdev-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Mon, Nov 06, 2006 at 09:44:49AM -0800, Stephen Hemminger wrote: > On Mon, 6 Nov 2006 12:33:53 +0100 > Jarek Poplawski wrote: > > > After hlist_del() next and pprev pointers are not NULL > > so hlist_unhashed() doesn't work properly. > > > > > > Signed-off-by: Jarek Poplawski > > --- > > > > > > diff -Nurp linux-2.6.19-rc4-git10-/net/sched/sch_htb.c linux-2.6.19-rc4-git10/net/sched/sch_htb.c > > --- linux-2.6.19-rc4-git10-/net/sched/sch_htb.c 2006-11-06 11:42:41.000000000 +0100 > > +++ linux-2.6.19-rc4-git10/net/sched/sch_htb.c 2006-11-06 11:53:15.000000000 +0100 > > @@ -1284,8 +1284,10 @@ static void htb_destroy_class(struct Qdi > > struct htb_class, sibling)); > > > > /* note: this delete may happen twice (see htb_delete) */ > > - if (!hlist_unhashed(&cl->hlist)) > > + if (!hlist_unhashed(&cl->hlist)) { > > hlist_del(&cl->hlist); > > + INIT_HLIST_NODE(&cl->hlist); > > + } > > why not use hlist_del_init? Yes, this is the question! As a matter of fact I expected another question. Yesterday I was short on time so I didn't describe the bug enough. I'm not sure if you know the problem, so here are more details (for me problem is 199% repeatable). After something like this: # tc qdisc add dev lo root handle 1: htb # tc class add dev lo parent 1: classid 1:1 htb rate 200kbps # tc class del dev lo classid 1:1 enter the BUG... I've found the last command is the culprit and if you do: # tc qdisc del dev lo root there is no problem. And probably it is enough to do the change only in htb_delete - btw. is this hlist_del really needed there? and shouldn't all deletions be done after zeroing the refcount? - but you should know better. > > > list_del(&cl->sibling); > > > > if (cl->prio_activity) > > @@ -1333,8 +1335,10 @@ static int htb_delete(struct Qdisc *sch, > > sch_tree_lock(sch); > > > > /* delete from hash and active; remainder in destroy_class */ > > - if (!hlist_unhashed(&cl->hlist)) > > + if (!hlist_unhashed(&cl->hlist)) { > > hlist_del(&cl->hlist); > > + INIT_HLIST_NODE(&cl->hlist); > > + } > > > > if (cl->prio_activity) > > htb_deactivate(q, cl); Best regards, Jarek P.