Hi, On 03/07/15 21:42, Florian Westphal wrote: > Julien Grall <julien.grall@xxxxxxxxxx> wrote: >> The commit efb6de9b4ba0092b2c55f6a52d16294a8a698edd "netfilter: bridge: >> forward IPv6 fragmented packets" introduced a new function >> br_validate_ipv6 which take a reference on the inet6 device. Although, >> the reference is not released at the end. >> >> This will result to the impossibility to destroy any netdevice using >> ipv6 and bridge. >> >> Spotted while trying to destroy a Xen guest on the upstream Linux: >> "unregister_netdevice: waiting for vif1.0 to become free. Usage count = 1" > > Ugh :-/ > > I think it makes more sense to use __in6_dev_get() instead which doesn't > take a reference. __in6_dev_get requires to hold rcu_read_lock or RTNL. My knowledge on this code is very limited. Are we sure that one this lock is hold? At first glance, I wasn't able to find one. Regards, -- Julien Grall
