[NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms
commit9cd40029423701c376391da59d2c6469672b4bed
authorPavel Emelyanov <xemul@openvz.org>
Thu, 10 Jan 2008 11:48:38 +0000 (10 03:48 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 10 Jan 2008 11:48:38 +0000 (10 03:48 -0800)
treea49624a361ab9c28879efc68862aee819538e9bc
parentb0de8e402dc5d3ee04f4d0f669ae492a3e569933
[NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms

The neightbl_fill_parms() is called under the write-locked tbl->lock
and accesses the parms->dev. The negh_parm_release() calls the
dev_put(parms->dev) without this lock. This creates a tiny race window
on which the parms contains potentially stale dev pointer.

To fix this race it's enough to move the dev_put() upper under the
tbl->lock, but note, that the parms are held by neighbors and thus can
live after the neigh_parms_release() is called, so we still can have a
parm with bad dev pointer.

I didn't find where the neigh->parms->dev is accessed, but still think
that putting the dev is to be done in a place, where the parms are
really freed. Am I right with that?

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/neighbour.c