BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 22:37:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

net/802/mrp: fix possible race condition when calling mrp_pdu_queue()

Browse Source 
(Adapted from a very similar change to net/802/garp.c by Cong Wang.)

mrp_pdu_queue() should ways be called with the applicant spin lock.
mrp_uninit_applicant() only holds the rtnl lock which is not enough;
a race is possible because mrp_rcv() is called in BH context:

	mrp_rcv()
	  |->mrp_pdu_parse_msg()
	    |->mrp_pdu_parse_vecattr()
	      |->mrp_pdu_parse_vecattr_event()
	        |-> mrp_attr_event()
	          |-> mrp_pdu_append_vecattr_event()
	            |-> mrp_pdu_queue()

Cc: Cong Wang <[email protected]>
Cc: Eric Dumazet <[email protected]>
Signed-off-by: David Ward <[email protected]>
Acked-by: Cong Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
David Ward authored and David S. Miller committed 2013-04-12 15:10:48 -04:00
1 parent 3be8fbab18
commit fb745e9a03
1 file changed
+4
Download Patch File Download Diff File Expand all files Collapse all files
net/802/mrp.c
+4
View File
@@ -870,8 +870,12 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
* all pending messages before the applicant is gone.
*/
del_timer_sync(&app->join_timer);
spin_lock(&app->lock);
mrp_mad_event(app, MRP_EVENT_TX);
mrp_pdu_queue(app);
spin_unlock(&app->lock);
mrp_queue_xmit(app);
dev_mc_del(dev, appl->group_address);