On Wed, 2012-06-06 at 17:53 +0200, Eric Dumazet wrote: > On Wed, 2012-06-06 at 18:49 +0400, Vladimir Davydov wrote: > > I'm not familiar with the linux net subsystem, so I would appreciate if > > someone could clarify if the following call chain is possible: > > > > addrconf_ifdown() calls neigh_ifdown(nd_tbl) which locks nd_tbl.lock for > > writing and calls > > > > pneigh_ifdown > > pndisc_destructor > > ipv6_dev_mc_dec > > __ipv6_dev_mc_dec > > igmp6_group_dropped > > igmp6_leave_group > > igmp6_send > > icmp6_dst_alloc > > ip6_neigh_lookup > > neigh_create > > > > and neigh_create() locks nd_tbl.lock for writing again resulting in a > > deadlock. > > It seems a deadlock is possible indeed, good catch ! > > And it seems this neigh_down() can be removed, its called later (after dev->ip6_ptr is cleared) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 8f6411c..62c4c00 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2750,7 +2750,6 @@ static int addrconf_ifdown(struct net_device *dev, int how) ASSERT_RTNL(); rt6_ifdown(net, dev); - neigh_ifdown(&nd_tbl, dev); idev = __in6_dev_get(dev); if (idev == NULL) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html