addrconf_del_timer() is sometimes done without a lock. IMHO it could be racy e.g. when between del_timer() and __in6_ifa_put() some other in6_ifa_put() is done.
addrconf_dad_kick() also runs unlocked in one place. BTW, I changed a bit one printk to be more precise, I hope. PS: this patch was prepared on 2.6.22-rc7 with my neighbouring PATCH 1/2, but they could be applied independently too. Signed-off-by: Jarek Poplawski <[EMAIL PROTECTED]> --- diff -Nurp 2.6.22-rc7-1_2/net/ipv6/addrconf.c 2.6.22-rc7-2_2/net/ipv6/addrconf.c --- 2.6.22-rc7-1_2/net/ipv6/addrconf.c 2007-07-05 12:33:34.000000000 +0200 +++ 2.6.22-rc7-2_2/net/ipv6/addrconf.c 2007-07-05 12:39:51.000000000 +0200 @@ -477,7 +477,7 @@ void inet6_ifa_finish_destroy(struct ine in6_dev_put(ifp->idev); if (del_timer(&ifp->timer)) - printk("Timer is still running, when freeing ifa=%p\n", ifp); + printk("Timer is still pending, when freeing ifa=%p\n", ifp); if (!ifp->dead) { printk("Freeing alive inet6 address %p\n", ifp); @@ -698,7 +698,9 @@ static void ipv6_del_addr(struct inet6_i atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifp); + spin_lock_bh(&ifp->lock); addrconf_del_timer(ifp); + spin_unlock_bh(&ifp->lock); /* * Purge or update corresponding prefix @@ -2427,7 +2429,9 @@ static int addrconf_ifdown(struct net_de if (ifa->idev == idev) { *bifa = ifa->lst_next; ifa->lst_next = NULL; + spin_lock_bh(&ifa->lock); addrconf_del_timer(ifa); + spin_unlock_bh(&ifa->lock); in6_ifa_put(ifa); continue; } @@ -2468,9 +2472,11 @@ static int addrconf_ifdown(struct net_de idev->addr_list = ifa->if_next; ifa->if_next = NULL; ifa->dead = 1; - addrconf_del_timer(ifa); write_unlock_bh(&idev->lock); + spin_lock_bh(&ifa->lock); + addrconf_del_timer(ifa); + spin_unlock_bh(&ifa->lock); __ipv6_ifa_notify(RTM_DELADDR, ifa); in6_ifa_put(ifa); @@ -2701,8 +2707,8 @@ static void addrconf_dad_run(struct inet spin_unlock_bh(&ifp->lock); continue; } - spin_unlock_bh(&ifp->lock); addrconf_dad_kick(ifp); + spin_unlock_bh(&ifp->lock); } read_unlock_bh(&idev->lock); } - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html