From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [PATCH net-next] 802: fix a possible race condition Date: Sat, 23 Mar 2013 13:14:08 +0800 Message-ID: <1364015648-4195-2-git-send-email-amwang@redhat.com> References: <1363938600-26129-1-git-send-email-amwang@redhat.com> <1364015648-4195-1-git-send-email-amwang@redhat.com> Cc: "David S. Miller" , David Ward , "Jorge Boncompte [DTI2]" , Cong Wang To: netdev@vger.kernel.org Return-path: Received: from mx1.redhat.com ([209.132.183.28]:49807 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755536Ab3CWFO3 (ORCPT ); Sat, 23 Mar 2013 01:14:29 -0400 In-Reply-To: <1364015648-4195-1-git-send-email-amwang@redhat.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Cong Wang garp_pdu_queue() should ways be called with this spin lock. garp_uninit_applicant() only holds rtnl lock which is not enough here. Found by code inspection. Cc: "David S. Miller" Cc: David Ward Cc: "Jorge Boncompte [DTI2]" Signed-off-by: Cong Wang --- net/802/garp.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/net/802/garp.c b/net/802/garp.c index 8456f5d..5d9630a 100644 --- a/net/802/garp.c +++ b/net/802/garp.c @@ -609,8 +609,12 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl /* Delete timer and generate a final TRANSMIT_PDU event to flush out * all pending messages before the applicant is gone. */ del_timer_sync(&app->join_timer); + + spin_lock_bh(&app->lock); garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); garp_pdu_queue(app); + spin_unlock_bh(&app->lock); + garp_queue_xmit(app); dev_mc_del(dev, appl->proto.group_address); -- 1.7.7.6