From patchwork Thu Mar 24 16:13:34 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bjorn Helgaas X-Patchwork-Id: 601657 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3qWBM55J9Zz9sBm for ; Fri, 25 Mar 2016 03:13:52 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754668AbcCXQNk (ORCPT ); Thu, 24 Mar 2016 12:13:40 -0400 Received: from mail.kernel.org ([198.145.29.136]:54089 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752780AbcCXQNi (ORCPT ); Thu, 24 Mar 2016 12:13:38 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 13250203AD; Thu, 24 Mar 2016 16:13:37 +0000 (UTC) Received: from localhost (unknown [69.71.1.1]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 280FA203A0; Thu, 24 Mar 2016 16:13:36 +0000 (UTC) Subject: [PATCH] netpoll: Fix extra refcount release in netpoll_cleanup() To: "David S. Miller" From: Bjorn Helgaas Cc: Nikolay Aleksandrov , netdev@vger.kernel.org, Neil Horman , Alexander Duyck , linux-kernel@vger.kernel.org Date: Thu, 24 Mar 2016 11:13:34 -0500 Message-ID: <20160324161334.31279.26510.stgit@bhelgaas-glaptop2.roam.corp.google.com> User-Agent: StGit/0.16 MIME-Version: 1.0 X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, NML_ADSP_CUSTOM_MED,UNPARSEABLE_RELAY autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org netpoll_setup() does a dev_hold() on np->dev, the netpoll device. If it fails, it correctly does a dev_put() but leaves np->dev set. If we call netpoll_cleanup() after the failure, np->dev is still set so we do another dev_put(), which decrements the refcount an extra time. It's questionable to call netpoll_cleanup() after netpoll_setup() fails, but it can be difficult to find the problem, and we can easily avoid it in this case. The extra decrements can lead to hangs like this: unregister_netdevice: waiting for bond0 to become free. Usage count = -3 In __netpoll_setup(), don't set np->dev until we know we're going to succeed. Signed-off-by: Bjorn Helgaas --- net/core/netpoll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/netpoll.c b/net/core/netpoll.c index 94acfc8..32e373e 100644 --- a/net/core/netpoll.c +++ b/net/core/netpoll.c @@ -603,7 +603,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) const struct net_device_ops *ops; int err; - np->dev = ndev; strlcpy(np->dev_name, ndev->name, IFNAMSIZ); INIT_WORK(&np->cleanup_work, netpoll_async_cleanup); @@ -628,7 +627,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) atomic_set(&npinfo->refcnt, 1); - ops = np->dev->netdev_ops; + ops = ndev->netdev_ops; if (ops->ndo_netpoll_setup) { err = ops->ndo_netpoll_setup(ndev, npinfo); if (err) @@ -639,6 +638,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) atomic_inc(&npinfo->refcnt); } + np->dev = ndev; npinfo->netpoll = np; /* last thing to do is link it to the net device structure */