| commit | b19cbe2a1695c09c74f83646c4b82b51123b3690 | |
| author | Patrick McHardy <kaber@trash.net> | |
| Thu, 22 Mar 2007 19:25:20 +0000 (22 12:25 -0700) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Thu, 22 Mar 2007 19:25:20 +0000 (22 12:25 -0700) | ||
| tree | 138761d3360b981292569e318757e53502f8887b | treesnapshot (tar.gz zip) |
| parent | ec25615b9ddd5c584b4066652840581fdb6c5e7a | commitdiff |
[BRIDGE]: Fix fdb RCU race
br_fdb_get use atomic_inc to increase the refcount of an element found
on a RCU protected list, which can lead to the following race:
CPU0 CPU1
br_fdb_get: rcu_read_lock
__br_fdb_get: find element
fdb_delete: hlist_del_rcu
br_fdb_put
br_fdb_put: atomic_dec_and_test
call_rcu(fdb_rcu_free) br_fdb_get: atomic_inc
rcu_read_unlock
fdb_rcu_free: kmem_cache_free
Use atomic_inc_not_zero instead.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
br_fdb_get use atomic_inc to increase the refcount of an element found
on a RCU protected list, which can lead to the following race:
CPU0 CPU1
br_fdb_get: rcu_read_lock
__br_fdb_get: find element
fdb_delete: hlist_del_rcu
br_fdb_put
br_fdb_put: atomic_dec_and_test
call_rcu(fdb_rcu_free) br_fdb_get: atomic_inc
rcu_read_unlock
fdb_rcu_free: kmem_cache_free
Use atomic_inc_not_zero instead.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| net/bridge/br_fdb.c | diffblobblamehistory |