From: Eric Dumazet Date: Tue, 9 Dec 2008 21:14:11 +0000 (-0800) Subject: percpu_counter: fix CPU unplug race in percpu_counter_destroy() X-Git-Tag: v2.6.28-rc8~29 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=fd3d664fef97cf01f8e28fe0b024ad52f3bbc1bc;p=linux-2.6-omap-h63xx.git percpu_counter: fix CPU unplug race in percpu_counter_destroy() We should first delete the counter from percpu_counters list before freeing memory, or a percpu_counter_hotcpu_callback() could dereference a NULL pointer. Signed-off-by: Eric Dumazet Acked-by: David S. Miller Cc: Peter Zijlstra Cc: Mingming Cao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c index a8663890a88..71b265c330c 100644 --- a/lib/percpu_counter.c +++ b/lib/percpu_counter.c @@ -104,13 +104,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc) if (!fbc->counters) return; - free_percpu(fbc->counters); - fbc->counters = NULL; #ifdef CONFIG_HOTPLUG_CPU mutex_lock(&percpu_counters_lock); list_del(&fbc->list); mutex_unlock(&percpu_counters_lock); #endif + free_percpu(fbc->counters); + fbc->counters = NULL; } EXPORT_SYMBOL(percpu_counter_destroy);