From: Linus Lüssing <[email protected]>

During the module shutdown procedure in batman_exit(), a rcu callback is
being scheduled (batman_exit -> hardif_remove_interfaces ->
hardif_remove_interfae -> call_rcu). However, when the kernel unloads
the module, the rcu callback might not have been executed yet, resulting
in a "unable to handle kernel paging request" in __rcu_process_callback
afterwards, causing the kernel to freeze.

The synchronize_net and synchronize_rcu in mesh_free are currently
called before the call_rcu in hardif_remove_interface and have no real
effect on it.

Therefore, we should always flush all rcu callback functions scheduled
during the shutdown procedure using synchronize_net. The call to
synchronize_rcu can be omitted because synchronize_net already calls it.

Signed-off-by: Linus Lüssing <[email protected]>
Signed-off-by: Sven Eckelmann <[email protected]>
---
 drivers/staging/batman-adv/main.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/batman-adv/main.c 
b/drivers/staging/batman-adv/main.c
index 498861f..b3e23e1 100644
--- a/drivers/staging/batman-adv/main.c
+++ b/drivers/staging/batman-adv/main.c
@@ -71,6 +71,8 @@ static void __exit batman_exit(void)
        flush_workqueue(bat_event_workqueue);
        destroy_workqueue(bat_event_workqueue);
        bat_event_workqueue = NULL;
+
+       synchronize_net();
 }
 
 int mesh_init(struct net_device *soft_iface)
@@ -132,9 +134,6 @@ void mesh_free(struct net_device *soft_iface)
        hna_local_free(bat_priv);
        hna_global_free(bat_priv);
 
-       synchronize_net();
-
-       synchronize_rcu();
        atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
 }
 
-- 
1.7.2.3

Reply via email to