neigh_create/inetdev_destroy race?

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

Hi:

I'm going through in_dev_get() callers.  The call in arp_constructor()
looks racy.  It takes in_dev->arp_parms and stores it in neigh->parms.

Is there any thing that prevents the following scenario from occuring?

CPU0                                    CPU1
neigh_create
                                        inet_del_ifa
                                                notifier_call_chain
                                                        neigh_ifdown
                                                inetdev_destroy
        arp_constructor
                neigh->parms =
                        in_dev->arp_parms
                                                        in_dev->dead = 1
                                                        in_dev->dev->ip_ptr =
                                                                NULL
                                                        neigh_parms_release
        n->parms->neigh_setup => BUG

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt