[PATCH] percpu_counter: fix CPU unplug race in percpu_counter_destroy()

[Eric Dumazet <dada1@cosmosbay.com>]

[-- Attachment #1: Type: text/plain, Size: 521 bytes --]

Hi Andrew

While working on percpu_counter on net-next-2.6, I found
a CPU unplug race in percpu_counter_destroy()

(Very unlikely of course)

Thank you

[PATCH] percpu_counter: fix CPU unplug race in percpu_counter_destroy()

We should first delete the counter from percpu_counters list
before freeing memory, or a percpu_counter_hotcpu_callback()
could dereference a NULL pointer.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
---
 lib/percpu_counter.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

[-- Attachment #2: percpu_counter_destroy.patch --]
[-- Type: text/plain, Size: 542 bytes --]

diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index a866389..71b265c 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -104,13 +104,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc)
 	if (!fbc->counters)
 		return;
 
-	free_percpu(fbc->counters);
-	fbc->counters = NULL;
 #ifdef CONFIG_HOTPLUG_CPU
 	mutex_lock(&percpu_counters_lock);
 	list_del(&fbc->list);
 	mutex_unlock(&percpu_counters_lock);
 #endif
+	free_percpu(fbc->counters);
+	fbc->counters = NULL;
 }
 EXPORT_SYMBOL(percpu_counter_destroy);