Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler()

[David Miller <davem@davemloft.net>]

From: Ding Tianhong <dingtianhong@huawei.com>
Date: Wed, 4 Dec 2013 12:04:31 +0800

> The destroying neigh could be trigger by userspace, just like set the ip address which
> in arp table to the local device ip, some I could not control it, it maybe anytime,
> but the timer handler is execute by logic, this is normal, so I think the logic
> is no problem, and the process of destroying neigh may conflict with the timer handler,
> it is a synchronous problem to make sure the timer should be finished before the
> reference neigh is freed.

The more I think about this, the more none of the explanations for this bug
make any sense.

neigh_destroy() _ONLY_ runs when:

	if (atomic_dec_and_test(&neigh->refcnt))

triggers in neigh_release().

This means it triggers if, and only if, neigh_refcnt goes to zero.

If the refcnt goes to zero, NO TIMER can be running.  If the timer is
running, then there refcnt must be at least '1'.

The only plausible theory would be that something is releasing a neigh
too early, when references to the neigh still actually exist.

And that's a bug that should be fixed.