From: David Woodhouse <dwmw2@infradead.org>
To: netdev@vger.kernel.org
Cc: chas@cmf.nrl.navy.mil, krzysiek@podlesie.net,
David Woodhouse <David.Woodhouse@intel.com>
Subject: [PATCH 11/17] br2684: fix module_put() race
Date: Fri, 30 Nov 2012 00:35:30 +0000 [thread overview]
Message-ID: <1354235736-26833-12-git-send-email-dwmw2@infradead.org> (raw)
In-Reply-To: <1354235736-26833-1-git-send-email-dwmw2@infradead.org>
From: David Woodhouse <David.Woodhouse@intel.com>
The br2684 code used module_put() during unassignment from vcc with
hope that we have BKL. This assumption is no longer true.
Now owner field in atmvcc is used to move this module_put()
to vcc_destroy_socket().
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
---
net/atm/br2684.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index c483021..373d784 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -68,6 +68,7 @@ struct br2684_vcc {
/* keep old push, pop functions for chaining */
void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
+ struct module *old_owner;
enum br2684_encaps encaps;
struct list_head brvccs;
#ifdef CONFIG_ATM_BR2684_IPFILTER
@@ -385,8 +386,8 @@ static void br2684_close_vcc(struct br2684_vcc *brvcc)
write_unlock_irq(&devs_lock);
brvcc->atmvcc->user_back = NULL; /* what about vcc->recvq ??? */
brvcc->old_push(brvcc->atmvcc, NULL); /* pass on the bad news */
+ module_put(brvcc->old_owner);
kfree(brvcc);
- module_put(THIS_MODULE);
}
/* when AAL5 PDU comes in: */
@@ -560,9 +561,11 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
brvcc->encaps = (enum br2684_encaps)be.encaps;
brvcc->old_push = atmvcc->push;
brvcc->old_pop = atmvcc->pop;
+ brvcc->old_owner = atmvcc->owner;
barrier();
atmvcc->push = br2684_push;
atmvcc->pop = br2684_pop;
+ atmvcc->owner = THIS_MODULE;
/* initialize netdev carrier state */
if (atmvcc->dev->signal == ATM_PHY_SIG_LOST)
--
1.8.0
next prev parent reply other threads:[~2012-11-30 0:36 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-30 0:35 [PATCH 00/17] ATM fixes for pppoatm/br2684 David Woodhouse
2012-11-30 0:35 ` [PATCH 01/17] atm: add owner of push() callback to atmvcc David Woodhouse
2012-11-30 0:35 ` [PATCH 02/17] pppoatm: allow assign only on a connected socket David Woodhouse
2012-11-30 0:35 ` [PATCH 03/17] pppoatm: fix module_put() race David Woodhouse
2012-11-30 0:35 ` [PATCH 04/17] pppoatm: take ATM socket lock in pppoatm_send() David Woodhouse
2012-11-30 0:35 ` [PATCH 05/17] pppoatm: drop frames to not-ready vcc David Woodhouse
2012-11-30 10:27 ` Krzysztof Mazur
2012-11-30 0:35 ` [PATCH 06/17] pppoatm: do not inline pppoatm_may_send() David Woodhouse
2012-11-30 0:35 ` [PATCH 07/17] solos-pci: Wait for pending TX to complete when releasing vcc David Woodhouse
2012-12-02 0:17 ` [PATCH v2 " David Woodhouse
2012-11-30 0:35 ` [PATCH 08/17] br2684: don't send frames on not-ready vcc David Woodhouse
2012-11-30 0:35 ` [PATCH 09/17] atm: Add release_cb() callback to vcc David Woodhouse
2012-11-30 0:35 ` [PATCH 10/17] pppoatm: fix missing wakeup in pppoatm_send() David Woodhouse
2012-11-30 0:35 ` David Woodhouse [this message]
2012-11-30 0:35 ` [PATCH 12/17] solos-pci: Fix leak of skb received for unknown vcc David Woodhouse
2012-11-30 0:35 ` [PATCH 13/17] br2684: allow assign only on a connected socket David Woodhouse
2012-11-30 0:35 ` [PATCH 14/17] pppoatm: optimise PPP channel wakeups after sock_owned_by_user() David Woodhouse
2012-11-30 0:35 ` [PATCH 15/17] solos-pci: clean up pclose() function David Woodhouse
2012-11-30 0:35 ` [PATCH 16/17] solos-pci: use GFP_KERNEL where possible, not GFP_ATOMIC David Woodhouse
2012-11-30 0:35 ` [PATCH 17/17] solos-pci: remove list_vccs() debugging function David Woodhouse
2012-11-30 10:44 ` [PATCH 00/17] ATM fixes for pppoatm/br2684 Krzysztof Mazur
2012-11-30 20:22 ` David Woodhouse
2012-12-01 16:43 ` David Miller
2012-12-01 16:44 ` David Miller
2012-12-01 16:48 ` David Woodhouse
2012-12-01 17:02 ` Chas Williams (CONTRACTOR)
2012-12-01 17:21 ` David Woodhouse
2012-12-02 1:57 ` Chas Williams (CONTRACTOR)
2012-12-02 2:17 ` David Miller
2012-12-01 17:33 ` David Woodhouse
2012-12-02 0:40 ` David Woodhouse
2012-12-02 1:49 ` David Miller
2012-12-02 8:14 ` David Woodhouse
2012-12-02 21:29 ` Checking struct size against sizeof(skb->cb) (was Re: [PATCH 00/17] ATM fixes for pppoatm/br2684) David Woodhouse
2012-12-20 14:03 ` skb->cb size checks " David Woodhouse
2012-12-02 0:35 ` [PATCH 00/17] ATM fixes for pppoatm/br2684 David Woodhouse
2012-12-02 1:47 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1354235736-26833-12-git-send-email-dwmw2@infradead.org \
--to=dwmw2@infradead.org \
--cc=David.Woodhouse@intel.com \
--cc=chas@cmf.nrl.navy.mil \
--cc=krzysiek@podlesie.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).