Revision b2238566401f01eb796e75750213c7b0fce396b2 authored by Andrey Vagin on 08 July 2008, 22:13:31 UTC, committed by David S. Miller on 08 July 2008, 22:13:31 UTC
Consider the following scenario:
ipv6_del_addr(ifp)
ipv6_ifa_notify(RTM_DELADDR, ifp)
ip6_del_rt(ifp->rt)
after returning from the ipv6_ifa_notify and enabling BH-s
back, but *before* calling the addrconf_del_timer the
ifp->timer fires and:
addrconf_dad_timer(ifp)
addrconf_dad_completed(ifp)
ipv6_ifa_notify(RTM_NEWADDR, ifp)
ip6_ins_rt(ifp->rt)
then return back to the ipv6_del_addr and:
in6_ifa_put(ifp)
inet6_ifa_finish_destroy(ifp)
dst_release(&ifp->rt->u.dst)
After this we have an ifp->rt inserted into fib6 lists, but
queued for gc, which in turn can result in oopses in the
fib6_run_gc. Maybe some other nasty things, but we caught
only the oops in gc so far.
The solution is to disarm the ifp->timer before flushing the
rt from it.
Signed-off-by: Andrey Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 07035fc
| File | Mode | Size |
|---|---|---|
| async_tx | ||
| Kconfig | -rw-r--r-- | 17.4 KB |
| Makefile | -rw-r--r-- | 2.4 KB |
| ablkcipher.c | -rw-r--r-- | 8.8 KB |
| aead.c | -rw-r--r-- | 12.2 KB |
| aes_generic.c | -rw-r--r-- | 13.5 KB |
| algapi.c | -rw-r--r-- | 14.1 KB |
| anubis.c | -rw-r--r-- | 27.8 KB |
| api.c | -rw-r--r-- | 9.7 KB |
| arc4.c | -rw-r--r-- | 2.0 KB |
| authenc.c | -rw-r--r-- | 13.0 KB |
| blkcipher.c | -rw-r--r-- | 19.0 KB |
| blowfish.c | -rw-r--r-- | 17.5 KB |
| camellia.c | -rw-r--r-- | 35.2 KB |
| cast5.c | -rw-r--r-- | 34.1 KB |
| cast6.c | -rw-r--r-- | 21.5 KB |
| cbc.c | -rw-r--r-- | 7.4 KB |
| ccm.c | -rw-r--r-- | 21.5 KB |
| chainiv.c | -rw-r--r-- | 7.9 KB |
| cipher.c | -rw-r--r-- | 3.3 KB |
| compress.c | -rw-r--r-- | 1.3 KB |
| crc32c.c | -rw-r--r-- | 2.6 KB |
| cryptd.c | -rw-r--r-- | 9.2 KB |
| crypto_null.c | -rw-r--r-- | 4.7 KB |
| cryptomgr.c | -rw-r--r-- | 4.4 KB |
| ctr.c | -rw-r--r-- | 10.8 KB |
| cts.c | -rw-r--r-- | 9.8 KB |
| deflate.c | -rw-r--r-- | 5.5 KB |
| des_generic.c | -rw-r--r-- | 35.3 KB |
| digest.c | -rw-r--r-- | 3.7 KB |
| ecb.c | -rw-r--r-- | 4.9 KB |
| eseqiv.c | -rw-r--r-- | 6.2 KB |
| fcrypt.c | -rw-r--r-- | 18.0 KB |
| gcm.c | -rw-r--r-- | 19.8 KB |
| gf128mul.c | -rw-r--r-- | 13.2 KB |
| hash.c | -rw-r--r-- | 2.7 KB |
| hmac.c | -rw-r--r-- | 7.1 KB |
| internal.h | -rw-r--r-- | 3.8 KB |
| khazad.c | -rw-r--r-- | 51.8 KB |
| lrw.c | -rw-r--r-- | 7.5 KB |
| lzo.c | -rw-r--r-- | 2.5 KB |
| md4.c | -rw-r--r-- | 6.2 KB |
| md5.c | -rw-r--r-- | 7.3 KB |
| michael_mic.c | -rw-r--r-- | 3.5 KB |
| pcbc.c | -rw-r--r-- | 7.7 KB |
| proc.c | -rw-r--r-- | 2.8 KB |
| salsa20_generic.c | -rw-r--r-- | 7.3 KB |
| scatterwalk.c | -rw-r--r-- | 2.9 KB |
| seed.c | -rw-r--r-- | 17.4 KB |
| seqiv.c | -rw-r--r-- | 8.2 KB |
| serpent.c | -rw-r--r-- | 19.8 KB |
| sha1_generic.c | -rw-r--r-- | 3.1 KB |
| sha256_generic.c | -rw-r--r-- | 12.2 KB |
| sha512_generic.c | -rw-r--r-- | 9.6 KB |
| tcrypt.c | -rw-r--r-- | 46.3 KB |
| tcrypt.h | -rw-r--r-- | 268.9 KB |
| tea.c | -rw-r--r-- | 7.1 KB |
| tgr192.c | -rw-r--r-- | 31.1 KB |
| twofish.c | -rw-r--r-- | 6.3 KB |
| twofish_common.c | -rw-r--r-- | 37.7 KB |
| wp512.c | -rw-r--r-- | 60.3 KB |
| xcbc.c | -rw-r--r-- | 9.0 KB |
| xor.c | -rw-r--r-- | 3.6 KB |
| xts.c | -rw-r--r-- | 7.1 KB |
Computing file changes ...
