1. 31 Oct, 2007 4 commits
    • Daniel Lezcano's avatar
      [IPV6]: remove duplicate call to proc_net_remove · 1675c7b2
      Daniel Lezcano authored
      The file /proc/net/if_inet6 is removed twice.
      First time in:
              inet6_exit
                   ->addrconf_cleanup
      And followed a few lines after by:
              inet6_exit
                   -> if6_proc_exit
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1675c7b2
    • Daniel Lezcano's avatar
      [NETNS]: fix net released by rcu callback · 310928d9
      Daniel Lezcano authored
      When a network namespace reference is held by a network subsystem,
      and when this reference is decremented in a rcu update callback, we
      must ensure that there is no more outstanding rcu update before
      trying to free the network namespace.
      
      In the normal case, the rcu_barrier is called when the network namespace
      is exiting in the cleanup_net function.
      
      But when a network namespace creation fails, and the subsystems are
      undone (like the cleanup), the rcu_barrier is missing.
      
      This patch adds the missing rcu_barrier.
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      310928d9
    • Daniel Lezcano's avatar
      [NET]: Fix free_netdev on register_netdev failure. · 93ee31f1
      Daniel Lezcano authored
      Point 1:
      The unregistering of a network device schedule a netdev_run_todo.
      This function calls dev->destructor when it is set and the
      destructor calls free_netdev.
      
      Point 2:
      In the case of an initialization of a network device the usual code
      is:
       * alloc_netdev
       * register_netdev
          -> if this one fails, call free_netdev and exit with error.
      
      Point 3:
      In the register_netdevice function at the later state, when the device
      is at the registered state, a call to the netdevice_notifiers is made.
      If one of the notification falls into an error, a rollback to the
      registered state is done using unregister_netdevice.
      
      Conclusion:
      When a network device fails to register during initialization because
      one network subsystem returned an error during a notification call
      chain, the network device is freed twice because of fact 1 and fact 2.
      The second free_netdev will be done with an invalid pointer.
      
      Proposed solution:
      The following patch move all the code of unregister_netdevice *except*
      the call to net_set_todo, to a new function "rollback_registered".
      
      The following functions are changed in this way:
       * register_netdevice: calls rollback_registered when a notification fails
       * unregister_netdevice: calls rollback_register + net_set_todo, the call
                               order to net_set_todo is changed because it is the
                               latest now. Since it justs add an element to a list
                               that should not break anything.
      Signed-off-by: default avatarDaniel Lezcano <dlezcano@fr.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      93ee31f1
    • Adrian Bunk's avatar
      5c41542b
  2. 30 Oct, 2007 36 commits