From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date: Tue, 27 Dec 2005 21:35:15 +0000 (-0800)
Subject: [IPV6]: Fix addrconf dead lock.
X-Git-Tag: v2.6.15~33
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6732badee0dad467fcc9dd0168af8677b2b1bc2f;p=linux-2.6

[IPV6]: Fix addrconf dead lock.

We need to release idev->lcok before we call addrconf_dad_stop().
It calls ipv6_addr_del(), which will hold idev->lock.

Bug spotted by Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2a6439e3c9..a60585fd85 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2467,11 +2467,9 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 		return;
 	}
 
-	if (idev->if_flags & IF_READY) {
-		addrconf_dad_kick(ifp);
-		spin_unlock_bh(&ifp->lock);
-	} else {
+	if (!(idev->if_flags & IF_READY)) {
 		spin_unlock_bh(&ifp->lock);
+		read_unlock_bh(&idev->lock);
 		/*
 		 * If the defice is not ready:
 		 * - keep it tentative if it is a permanent address.
@@ -2479,7 +2477,10 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 		 */
 		in6_ifa_hold(ifp);
 		addrconf_dad_stop(ifp);
+		return;
 	}
+	addrconf_dad_kick(ifp);
+	spin_unlock_bh(&ifp->lock);
 out:
 	read_unlock_bh(&idev->lock);
 }