Commit:     9cd40029423701c376391da59d2c6469672b4bed
Parent:     b0de8e402dc5d3ee04f4d0f669ae492a3e569933
Author:     Pavel Emelyanov <[EMAIL PROTECTED]>
AuthorDate: Thu Jan 10 03:48:38 2008 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Thu Jan 10 03:48:38 2008 -0800

    [NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms
    The neightbl_fill_parms() is called under the write-locked tbl->lock
    and accesses the parms->dev. The negh_parm_release() calls the
    dev_put(parms->dev) without this lock. This creates a tiny race window
    on which the parms contains potentially stale dev pointer.
    To fix this race it's enough to move the dev_put() upper under the
    tbl->lock, but note, that the parms are held by neighbors and thus can
    live after the neigh_parms_release() is called, so we still can have a
    parm with bad dev pointer.
    I didn't find where the neigh->parms->dev is accessed, but still think
    that putting the dev is to be done in a place, where the parms are
    really freed. Am I right with that?
    Signed-off-by: Pavel Emelyanov <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/core/neighbour.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 29b8ee4..cc8a2f1 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1316,8 +1316,6 @@ void neigh_parms_release(struct neigh_table *tbl, struct 
neigh_parms *parms)
                        *p = parms->next;
                        parms->dead = 1;
-                       if (parms->dev)
-                               dev_put(parms->dev);
                        call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
@@ -1328,6 +1326,8 @@ void neigh_parms_release(struct neigh_table *tbl, struct 
neigh_parms *parms)
 void neigh_parms_destroy(struct neigh_parms *parms)
+       if (parms->dev)
+               dev_put(parms->dev);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to