On Mon, 2016-09-19 at 18:48 +0800, Herbert Xu wrote:

On Mon, Sep 19, 2016 at 12:10:27PM +0200, Johannes Berg wrote:

quoted

Btw, for debug I put

BUG_ON(atomic_read(&ht->nelems) < 0);

after the atomic_dec() in __rhashtable_remove_fast_one(). That
makes
the kernel crash instantly on the buggy code, and I just have to
run a
single test ("wpas_ctrl_interface_add_many") to get there.

Aha I see the problem now.  The nelems logic on remove is broken.

I looked at it for a long time, but didn't see it :) But yeah, I've
come to the same conclusion by adding debugging of the chains etc.

I'll send out a v3.

I'll test it when I have it :)

johannes