lkml.org 
[lkml]   [2005]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[patch 022/198] Fix dst_destroy() race
From
Date

From: Herbert Xu <herbert@gondor.apana.org.au>

When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.

In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

25-akpm/net/core/dst.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)

diff -puN net/core/dst.c~fix-dst_destroy-race net/core/dst.c
--- 25/net/core/dst.c~fix-dst_destroy-race 2005-04-12 03:21:08.534839408 -0700
+++ 25-akpm/net/core/dst.c 2005-04-12 03:21:08.537838952 -0700
@@ -198,13 +198,15 @@ again:

dst = child;
if (dst) {
+ int nohash = dst->flags & DST_NOHASH;
+
if (atomic_dec_and_test(&dst->__refcnt)) {
/* We were real parent of this dst, so kill child. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
goto again;
} else {
/* Child is still referenced, return it for freeing. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
return dst;
/* Child is still in his hash table */
}
_
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-04-13 03:28    [W:0.032 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site