tree c24ede63d9f2eb303744d5c96c8f5294cee3c1db
parent 2a27805127aee1e7e62854bcf9ca8c355c23b73e
author Herbert Xu <[EMAIL PROTECTED]> Sun, 17 Apr 2005 05:24:10 -0700
committer Linus Torvalds <[EMAIL PROTECTED]> Sun, 17 Apr 2005 05:24:10 -0700
[PATCH] Fix dst_destroy() race
When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.
In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.
Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>
Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
core/dst.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
Index: net/core/dst.c
===================================================================
--- d76f7f634e43bf3797657c5cb2d2b222ffd76f8b/net/core/dst.c (mode:100644
sha1:3bf6cc4348141ef8961475dce214c91dcf07bb72)
+++ c24ede63d9f2eb303744d5c96c8f5294cee3c1db/net/core/dst.c (mode:100644
sha1:fc434ade5270e1b99770a9a5f91b2a8747a50093)
@@ -198,13 +198,15 @@
dst = child;
if (dst) {
+ int nohash = dst->flags & DST_NOHASH;
+
if (atomic_dec_and_test(&dst->__refcnt)) {
/* We were real parent of this dst, so kill child. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
goto again;
} else {
/* Child is still referenced, return it for freeing. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
return dst;
/* Child is still in his hash table */
}
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
