* [PATCH net-next-2.6] fib: use atomic_inc_not_zero() in fib_rules_lookup
@ 2010-09-27 14:18 Eric Dumazet
2010-09-28 4:51 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2010-09-27 14:18 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Paul E. McKenney
It seems we dont use appropriate refcount increment in an
rcu_read_lock() protected section.
fib_rule_get() might increment a null refcount and bad things could
happen.
While fib_nl_delrule() respects an rcu grace period before calling
fib_rule_put(), fib_rules_cleanup_ops() calls fib_rule_put() without a
grace period.
Note : after this patch, we might avoid the synchronize_rcu() call done
in fib_nl_delrule()
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
net/core/fib_rules.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 42e84e0..910eac3 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -225,9 +225,11 @@ jumped:
err = ops->action(rule, fl, flags, arg);
if (err != -EAGAIN) {
- fib_rule_get(rule);
- arg->rule = rule;
- goto out;
+ if (likely(atomic_inc_not_zero(&rule->refcnt))) {
+ arg->rule = rule;
+ goto out;
+ }
+ break;
}
}
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net-next-2.6] fib: use atomic_inc_not_zero() in fib_rules_lookup
2010-09-27 14:18 [PATCH net-next-2.6] fib: use atomic_inc_not_zero() in fib_rules_lookup Eric Dumazet
@ 2010-09-28 4:51 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2010-09-28 4:51 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, paulmck
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 27 Sep 2010 16:18:27 +0200
> It seems we dont use appropriate refcount increment in an
> rcu_read_lock() protected section.
>
> fib_rule_get() might increment a null refcount and bad things could
> happen.
>
> While fib_nl_delrule() respects an rcu grace period before calling
> fib_rule_put(), fib_rules_cleanup_ops() calls fib_rule_put() without a
> grace period.
>
> Note : after this patch, we might avoid the synchronize_rcu() call done
> in fib_nl_delrule()
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-09-28 4:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-09-27 14:18 [PATCH net-next-2.6] fib: use atomic_inc_not_zero() in fib_rules_lookup Eric Dumazet
2010-09-28 4:51 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).