Skip to content

Commit

Permalink
netpoll: Fix extra refcount release in netpoll_cleanup()
Browse files Browse the repository at this point in the history
netpoll_setup() does a dev_hold() on np->dev, the netpoll device.  If it
fails, it correctly does a dev_put() but leaves np->dev set.  If we call
netpoll_cleanup() after the failure, np->dev is still set so we do another
dev_put(), which decrements the refcount an extra time.

It's questionable to call netpoll_cleanup() after netpoll_setup() fails,
but it can be difficult to find the problem, and we can easily avoid it in
this case.  The extra decrements can lead to hangs like this:

  unregister_netdevice: waiting for bond0 to become free. Usage count = -3

Set and clear np->dev at the points where we dev_hold() and dev_put() the
device.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Bjorn Helgaas authored and David S. Miller committed Mar 25, 2016
1 parent 7dd3991 commit 543e3a8
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion net/core/netpoll.c
Original file line number Diff line number Diff line change
Expand Up @@ -603,7 +603,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
const struct net_device_ops *ops;
int err;

np->dev = ndev;
strlcpy(np->dev_name, ndev->name, IFNAMSIZ);
INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);

Expand Down Expand Up @@ -670,6 +669,7 @@ int netpoll_setup(struct netpoll *np)
goto unlock;
}
dev_hold(ndev);
np->dev = ndev;

if (netdev_master_upper_dev_get(ndev)) {
np_err(np, "%s is a slave device, aborting\n", np->dev_name);
Expand Down Expand Up @@ -770,6 +770,7 @@ int netpoll_setup(struct netpoll *np)
return 0;

put:
np->dev = NULL;
dev_put(ndev);
unlock:
rtnl_unlock();
Expand Down

0 comments on commit 543e3a8

Please sign in to comment.