Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check

[David Miller <davem@davemloft.net>]

From: Stephen Hemminger <shemminger@linux-foundation.org>
Date: Tue, 13 Feb 2007 11:55:29 -0800

> On Tue, 13 Feb 2007 07:26:51 +0100
> Jarek Poplawski <jarkao2@o2.pl> wrote:
> 
> > On Mon, Feb 12, 2007 at 09:47:38AM -0800, Stephen Hemminger wrote:
> > > On Mon, 12 Feb 2007 11:28:48 +0100
> > > Jarek Poplawski <jarkao2@o2.pl> wrote:
> > > 
> > > > Here is my patch proposal for testing.
> > > > If it doesn't work - forget about it.
> > > > (Prepared with 2.6.20-git6 but could
> > > > be applied to 2.6.20 also.)
> > > > 
> > > > Jarek P.
> > > > 
> > > > 
> > > > dev_hold/dev_put added to prevent dev kfree
> > > > during port_carrier_check runnig, while dev
> > > > and port are removed.
> > > 
> > > No, holding the reference just stops the kfree, it doesn't
> > > stop the device from being removed from the port.
> > 
> > But I wrote above it is only to prevent the kfree.
> > 
> > >        p = dev->br_port;
> > >        if (!p)
> > >                goto done;
> > >        br = p->br;
> > 
> > Then p is NULL here and we goto done.
> > 
> > Sorry, but the first version was wrong (incomplete).
> > Below I attach a new proposal.
> > 
> > 
> > Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
> 
> Yes, this looks correct.  If carrier_check is pending the ref count
> gets cleared by cancel. If carrier work is waiting for rtnl, then
> it cleans itself up.

I've applied this patch, thanks everyone.

Stephen, do we want this in -stable?