Re: [Xen-devel] [PATCH] patches: workaround for br_del_if race

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

> If the destory_nbp_rcu() callback isn't fired before br_device_event()
> checks dev->br_port, then the NULL check fails and a second call to
> br_del_if() is invoked and we blow up in sysfs/kobject BUG_ON() for ref
> counts of dentrys. [2]
> 
> Before I go back to netdev, I wanted to check if there is anything we
> should be doing to be more defensive or does this seem to be something
> the bridge code should handle (error out, whatever)?

I think this is an etherbridge bug. They've set up two ways to enter
br_del_if() but haven't implemented proper synchronisation in that
function. The fact that br_del_if has been called once already but has
only 'half deleted' the bridge port is an implementation detail of the
etherbridge --- network interfaces shouldn't have to code around that.

I expect that all other network drivers have this same problem but
it's just really rare to unregister_netdev() a real NIC so noone's hit
it before.

 -- Keir

> 1. http://oss.sgi.com/archives/netdev/2005-08/msg00097.html
> 2. Routines are in linux/net/bridge/{br_if.c, br_ioctl.c, br_notify.c}
> 
> -- 
> Ryan Harper
> Software Engineer; Linux Technology Center
> IBM Corp., Austin, Tx
> (512) 838-9253   T/L: 678-9253
> ryanh@xxxxxxxxxx
> 


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel