netpoll: Fix extra refcount release in netpoll_cleanup()
netpoll_setup() does a dev_hold() on np->dev, the netpoll device. If it fails, it correctly does a dev_put() but leaves np->dev set. If we call netpoll_cleanup() after the failure, np->dev is still set so we do another dev_put(), which decrements the refcount an extra time. It's questionable to call netpoll_cleanup() after netpoll_setup() fails, but it can be difficult to find the problem, and we can easily avoid it in this case. The extra decrements can lead to hangs like this: unregister_netdevice: waiting for bond0 to become free. Usage count = -3 Set and clear np->dev at the points where we dev_hold() and dev_put() the device. Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7dd399130e
commit
543e3a8da5
|
@ -603,7 +603,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
|
|||
const struct net_device_ops *ops;
|
||||
int err;
|
||||
|
||||
np->dev = ndev;
|
||||
strlcpy(np->dev_name, ndev->name, IFNAMSIZ);
|
||||
INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);
|
||||
|
||||
|
@ -670,6 +669,7 @@ int netpoll_setup(struct netpoll *np)
|
|||
goto unlock;
|
||||
}
|
||||
dev_hold(ndev);
|
||||
np->dev = ndev;
|
||||
|
||||
if (netdev_master_upper_dev_get(ndev)) {
|
||||
np_err(np, "%s is a slave device, aborting\n", np->dev_name);
|
||||
|
@ -770,6 +770,7 @@ int netpoll_setup(struct netpoll *np)
|
|||
return 0;
|
||||
|
||||
put:
|
||||
np->dev = NULL;
|
||||
dev_put(ndev);
|
||||
unlock:
|
||||
rtnl_unlock();
|
||||
|
|
Loading…
Reference in a new issue