[BRIDGE]: Possible race with timer on shutdown.

net/bridge/br_device.c

@@ -105,12 +105,7 @@ static void br_dev_set_multicast_list(struct net_device *dev)
 
 static int br_dev_stop(struct net_device *dev)
 {
-	struct net_bridge *br;
-
-	br = dev->priv;
-	write_lock(&br->lock);
-	br_stp_disable_bridge(br);
-	write_unlock(&br->lock);
+	br_stp_disable_bridge(dev->priv);
 
 	netif_stop_queue(dev);
 

net/bridge/br_stp_if.c

@@ -64,11 +64,12 @@ void br_stp_enable_bridge(struct net_bridge *br)
 	br_timer_set(&br->gc_timer, jiffies);
 }
 
-/* called under bridge lock */
+/* NO locks held */
 void br_stp_disable_bridge(struct net_bridge *br)
 {
 	struct net_bridge_port *p;
 
+	write_lock(&br->lock);
 	br->topology_change = 0;
 	br->topology_change_detected = 0;
 	br_timer_clear(&br->hello_timer);
@@ -84,6 +85,7 @@ void br_stp_disable_bridge(struct net_bridge *br)
 
 		p = p->next;
 	}
+	write_unlock(&br->lock);
 
 	del_timer_sync(&br->tick);
 }