Fw: unregister_netdevice(): negative refcnt, suggest patch against 2.6.11

[Andrew Morton <akpm@xxxxxxxx>]

That sounds like a bug in appletalk or in the tap driver.  Please describe
a means by which other developers can reproduce that bug (a sequence of
shell commands would be ideal).

Thanks.



Begin forwarded message:

Date: Sun, 10 Apr 2005 11:16:25 +0200
From: Felix Palmen <fmp@xxxxxxxxxxxxxxxxx>
To: linux-kernel@xxxxxxxxxxxxxxx
Subject: unregister_netdevice(): negative refcnt, suggest patch against 2.6.11


Hi lkml-members,

I recently had a problem with appletalk. After starting atalkd on a TAP
interface and stopping it later, unregister_netdevice() just stated
| unregister_netdevice: waiting for tap0 to become free. Usage count = -1

So I assume there is a problem in the appletalk code, but I didn't try
reproducing that on other systems so far.

I changed my kernel to "correct" a negative refcnt to 0 and that kind
of fixes the problem. I'm not sure whether this could break anything,
but certainly waiting for a device to become free is no use when there
is a negative number of users, so I think it would be better to allow
the system to shut down cleanly in this case.

Here's m suggestion:

#v+
--- linux-2.6.11-orig/net/core/dev.c 2005-03-02 08:38:09.000000000 +0100
+++ linux-2.6.11/net/core/dev.c    2005-04-09 16:44:42.000000000 +0200
@@ -2876,7 +2876,7 @@
        unsigned long rebroadcast_time, warning_time;

        rebroadcast_time = warning_time = jiffies;
-       while (atomic_read(&dev->refcnt) != 0) {
+       while (atomic_read(&dev->refcnt) > 0) {
                if (time_after(jiffies, rebroadcast_time + 1 * HZ)) {
                        rtnl_shlock();

@@ -2910,6 +2910,13 @@
                        warning_time = jiffies;
                }
        }
+       if (atomic_read(&dev->refcnt) != 0) {
+               printk(KERN_ERR "unregister_netdevice: "
+                       "%s has negative refcnt (%d). "
+                       "This should never happen! Setting refcnt to 0.\n",
+                       dev->name, atomic_read(&dev->refcnt));
+               atomic_set(&dev->refcnt, 0);
+       }
 }

 /* The sequence is:
#v-

Greets, Felix

PS: Please note I'm not subscribed to lkml and CC me in replies, thanks.

-- 
 | /"\   ASCII Ribbon   | Felix M. Palmen (Zirias)    http://zirias.ath.cx/ |
 | \ / Campaign Against | fmp@xxxxxxxxxxxxxxxxx      encrypted mail welcome |
 |  X    HTML In Mail   | PGP key: http://zirias.ath.cx/pub.txt             |
 | / \     And News     | ED9B 62D0 BE39 32F9 2488 5D0C 8177 9D80 5ECF F683 |

signature.asc
Description: PGP signature