From: Patrick McHardy Date: Thu, 22 Mar 2007 19:25:20 +0000 (-0700) Subject: [BRIDGE]: Fix fdb RCU race X-Git-Tag: v2.6.21-rc5~45^2~4 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=b19cbe2a1695c09c74f83646c4b82b51123b3690;p=linux-2.6-omap-h63xx.git [BRIDGE]: Fix fdb RCU race br_fdb_get use atomic_inc to increase the refcount of an element found on a RCU protected list, which can lead to the following race: CPU0 CPU1 br_fdb_get: rcu_read_lock __br_fdb_get: find element fdb_delete: hlist_del_rcu br_fdb_put br_fdb_put: atomic_dec_and_test call_rcu(fdb_rcu_free) br_fdb_get: atomic_inc rcu_read_unlock fdb_rcu_free: kmem_cache_free Use atomic_inc_not_zero instead. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c index def2e403f93..8d566c13cc7 100644 --- a/net/bridge/br_fdb.c +++ b/net/bridge/br_fdb.c @@ -197,8 +197,8 @@ struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br, rcu_read_lock(); fdb = __br_fdb_get(br, addr); - if (fdb) - atomic_inc(&fdb->use_count); + if (fdb && !atomic_inc_not_zero(&fdb->use_count)) + fdb = NULL; rcu_read_unlock(); return fdb; }