Commit:     b19cbe2a1695c09c74f83646c4b82b51123b3690
Parent:     ec25615b9ddd5c584b4066652840581fdb6c5e7a
Author:     Patrick McHardy <[EMAIL PROTECTED]>
AuthorDate: Thu Mar 22 12:25:20 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Thu Mar 22 12:25:20 2007 -0700

    [BRIDGE]: Fix fdb RCU race
    br_fdb_get use atomic_inc to increase the refcount of an element found
    on a RCU protected list, which can lead to the following race:
    CPU0                                        CPU1
                                        br_fdb_get:   rcu_read_lock
                                        __br_fdb_get: find element
    fdb_delete:   hlist_del_rcu
    br_fdb_put:   atomic_dec_and_test
              call_rcu(fdb_rcu_free)    br_fdb_get:   atomic_inc
    fdb_rcu_free: kmem_cache_free
    Use atomic_inc_not_zero instead.
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/bridge/br_fdb.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index def2e40..8d566c1 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -197,8 +197,8 @@ struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge 
        fdb = __br_fdb_get(br, addr);
-       if (fdb)
-               atomic_inc(&fdb->use_count);
+       if (fdb && !atomic_inc_not_zero(&fdb->use_count))
+               fdb = NULL;
        return fdb;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to