Revision b2238566401f01eb796e75750213c7b0fce396b2 authored by Andrey Vagin on 08 July 2008, 22:13:31 UTC, committed by David S. Miller on 08 July 2008, 22:13:31 UTC
Consider the following scenario: ipv6_del_addr(ifp) ipv6_ifa_notify(RTM_DELADDR, ifp) ip6_del_rt(ifp->rt) after returning from the ipv6_ifa_notify and enabling BH-s back, but *before* calling the addrconf_del_timer the ifp->timer fires and: addrconf_dad_timer(ifp) addrconf_dad_completed(ifp) ipv6_ifa_notify(RTM_NEWADDR, ifp) ip6_ins_rt(ifp->rt) then return back to the ipv6_del_addr and: in6_ifa_put(ifp) inet6_ifa_finish_destroy(ifp) dst_release(&ifp->rt->u.dst) After this we have an ifp->rt inserted into fib6 lists, but queued for gc, which in turn can result in oopses in the fib6_run_gc. Maybe some other nasty things, but we caught only the oops in gc so far. The solution is to disarm the ifp->timer before flushing the rt from it. Signed-off-by: Andrey Vagin <avagin@parallels.com> Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 07035fc
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
usr | ||
virt | ||
.gitignore | -rw-r--r-- | 867 bytes |
.mailmap | -rw-r--r-- | 3.6 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 90.5 KB |
Kbuild | -rw-r--r-- | 2.4 KB |
MAINTAINERS | -rw-r--r-- | 98.3 KB |
Makefile | -rw-r--r-- | 53.8 KB |
README | -rw-r--r-- | 16.5 KB |
REPORTING-BUGS | -rw-r--r-- | 3.1 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...