diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2005-04-16 15:24:10 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2005-04-16 15:24:10 -0700 |
| commit | 6775cab98b89b2caa10dce4b07e2c81999e45517 (patch) | |
| tree | c24ede63d9f2eb303744d5c96c8f5294cee3c1db /net/core/dst.c | |
| parent | 2a27805127aee1e7e62854bcf9ca8c355c23b73e (diff) | |
| download | kernel-mfld-blackbay-6775cab98b89b2caa10dce4b07e2c81999e45517.tar.gz kernel-mfld-blackbay-6775cab98b89b2caa10dce4b07e2c81999e45517.tar.bz2 kernel-mfld-blackbay-6775cab98b89b2caa10dce4b07e2c81999e45517.zip | |
[PATCH] Fix dst_destroy() race
When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.
In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/core/dst.c')
| -rw-r--r-- | net/core/dst.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/core/dst.c b/net/core/dst.c index 3bf6cc43481..fc434ade527 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -198,13 +198,15 @@ again: dst = child; if (dst) { + int nohash = dst->flags & DST_NOHASH; + if (atomic_dec_and_test(&dst->__refcnt)) { /* We were real parent of this dst, so kill child. */ - if (dst->flags&DST_NOHASH) + if (nohash) goto again; } else { /* Child is still referenced, return it for freeing. */ - if (dst->flags&DST_NOHASH) + if (nohash) return dst; /* Child is still in his hash table */ } |