diff options
author | Allan Stephens <allan.stephens@windriver.com> | 2008-05-12 15:42:28 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-05-12 15:42:28 -0700 |
commit | 7ef43ebaa538e0cc9063cbf84593a05091bcace2 (patch) | |
tree | d2bac748f6620cc2f217672105918b2116f6c958 /net/tipc/ref.c | |
parent | 4e3e6dcb43c3669a8817cb3d0f920f91661afd98 (diff) | |
download | linux-3.10-7ef43ebaa538e0cc9063cbf84593a05091bcace2.tar.gz linux-3.10-7ef43ebaa538e0cc9063cbf84593a05091bcace2.tar.bz2 linux-3.10-7ef43ebaa538e0cc9063cbf84593a05091bcace2.zip |
tipc: Fix race condition when creating socket or native port
This patch eliminates the (very remote) chance of a crash resulting
from a partially initialized socket or native port unexpectedly
receiving a message. Now, during the creation of a socket or native
port, the underlying generic port's lock is not released until all
initialization required to handle incoming messages has been done.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc/ref.c')
-rw-r--r-- | net/tipc/ref.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/net/tipc/ref.c b/net/tipc/ref.c index 89cbab24d08..a101de86824 100644 --- a/net/tipc/ref.c +++ b/net/tipc/ref.c @@ -142,9 +142,13 @@ void tipc_ref_table_stop(void) /** * tipc_ref_acquire - create reference to an object * - * Return a unique reference value which can be translated back to the pointer - * 'object' at a later time. Also, pass back a pointer to the lock protecting - * the object, but without locking it. + * Register an object pointer in reference table and lock the object. + * Returns a unique reference value that is used from then on to retrieve the + * object pointer, or to determine that the object has been deregistered. + * + * Note: The object is returned in the locked state so that the caller can + * register a partially initialized object, without running the risk that + * the object will be accessed before initialization is complete. */ u32 tipc_ref_acquire(void *object, spinlock_t **lock) @@ -178,13 +182,13 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock) ref = (next_plus_upper & ~index_mask) + index; entry->ref = ref; entry->object = object; - spin_unlock_bh(&entry->lock); *lock = &entry->lock; } else if (tipc_ref_table.init_point < tipc_ref_table.capacity) { index = tipc_ref_table.init_point++; entry = &(tipc_ref_table.entries[index]); spin_lock_init(&entry->lock); + spin_lock_bh(&entry->lock); ref = tipc_ref_table.start_mask + index; entry->ref = ref; entry->object = object; |