> If the loops runs once or twice that is not a bug, it is possible for
> processes to grab onto the device via rtnetlink queries and similar
> and we have to pause and potentially schedule to deal with that.
Yes. I guess rtnetlink_rcv() calls netdev_run_todo() to handle that case.
> The core problem is that we end up putting the device reference to
> zero a second time, and for that reason we should prevent it by
> holding onto a reference around the entire loop and wait for the
> refcount to drop to '1'.
That was my original intention, but won't a driver that calls
unregister_netdevice() followed by a free_netdev() still panic the
system ? Since the netdev_run_todo() can run after this is done and
derefernce the 'dev'. (Or is the refcount of the dev->kobject going
to be > 1 and hence not freed ? This class/object code is new to me).