Re: [PATCH] bonding: clear header_ops when last slave detached (v2)

[Jay Vosburgh <jay.vosburgh@canonical.com>]

Cong Wang <cwang@twopensource.com> wrote:

>Also, no one seems to care about my previous question:
>why only bonding has the problem?

	Bonding has the problem because it stashes a pointer to a data
structure (the header_ops) from another module, and when that module is
unloaded the dangling pointer may be dereferenced if it's not either
cleared or made to never go away.

	Setting the bonding->header_ops to NULL (to avoid the current
problem with pktgen) has a race in dev_hard_header between where the
header_ops pointer is checked and where the ->create function is called.

	This pointer business is the main reason the bonding path for
"not ARPHRD_ETHER" (i.e., ipoib) has extra complexity in the open/close
path, e.g.,

bond_slave_netdev_event():
[...]
        switch (event) {
        case NETDEV_UNREGISTER:
                if (bond_dev->type != ARPHRD_ETHER)
                        bond_release_and_destroy(bond_dev, slave_dev);
                else
                        bond_release(bond_dev, slave_dev);

	If the ipoib ops were static in vmlinux, that would resolve the
pktgen problem, and also may eliminate the need for some of the ugly
bits like what I've pasted in above.

	-J

---
	-Jay Vosburgh, jay.vosburgh@canonical.com