[3.8.y.z extended stable] Patch "ipv6 mcast: use in6_dev_put in timer handlers instead of" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    ipv6 mcast: use in6_dev_put in timer handlers instead of

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.12.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 9cd7b801533ec9a9481374e08d8eec570b02ec85 Mon Sep 17 00:00:00 2001
From: Salam Noureddine <noureddine at aristanetworks.com>
Date: Sun, 29 Sep 2013 13:41:34 -0700
Subject: ipv6 mcast: use in6_dev_put in timer handlers instead of
 __in6_dev_put

[ Upstream commit 9260d3e1013701aa814d10c8fc6a9f92bd17d643 ]

It is possible for the timer handlers to run after the call to
ipv6_mc_down so use in6_dev_put instead of __in6_dev_put in the
handler function in order to do proper cleanup when the refcnt
reaches 0. Otherwise, the refcnt can reach zero without the
inet6_dev being destroyed and we end up leaking a reference to
the net_device and see messages like the following,

unregister_netdevice: waiting for eth0 to become free. Usage count = 1

Tested on linux-3.4.43.

Signed-off-by: Salam Noureddine <noureddine at aristanetworks.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 net/ipv6/mcast.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 79fa628..ac1b533 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2155,7 +2155,7 @@ static void mld_gq_timer_expire(unsigned long data)

 	idev->mc_gq_running = 0;
 	mld_send_report(idev, NULL);
-	__in6_dev_put(idev);
+	in6_dev_put(idev);
 }

 static void mld_ifc_timer_expire(unsigned long data)
@@ -2168,7 +2168,7 @@ static void mld_ifc_timer_expire(unsigned long data)
 		if (idev->mc_ifc_count)
 			mld_ifc_start_timer(idev, idev->mc_maxdelay);
 	}
-	__in6_dev_put(idev);
+	in6_dev_put(idev);
 }

 static void mld_ifc_event(struct inet6_dev *idev)
--
1.8.1.2