Hello Eric,

On (11/23/10 15:33), Eric Dumazet wrote:
> Sergey, I dont think your patches (V1 or V2) are correct.
> 
> You leak a refcount if (idev->dead) is true
>
Hm, that's true. Thank you.

 
> ipv6_regen_rndid() is the timer handler function, it must call
> in6_dev_put() at the end, unless we rearm the timer.
> 
> So this code is correct.
> 
> 
> if (!mod_timer(&idev->regen_timer, expires))
> 	in6_dev_hold(idev);
> ...
> in6_dev_put(idev);
>

Even if in6_dev_hold hasn't been called from ipv6_regen_rndid?


> 
> And we must call in6_dev_hold() before calling the handler, either
> directly from ipv6_add_dev() [Where your first patch tried to remove the
> dev_hold() call], or when arming the timer.
> 
> Are you sure the problem you try to solve is not already solved in
> commit 88b2a9a3d98a19496d64aadda7158c0ad51cbe7d in net-2.6 tree ?
> 
> http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git;a=commitdiff;h=88b2a9a3d98a19496d64aadda7158c0ad51cbe7d
> 

Oh, haven't seen this one. I'll try, thank you.


	Sergey