[PATCH net] bridge: fix race with topology change timer

[PATCH net] bridge: fix race with topology change timer

[Stephen Hemminger]

A bridge should only send topology change notice if it is not
the root bridge. It is possible for message age timer to elect itself
as a new root bridge, and still have a topology change timer running
but waiting for bridge lock on other CPU.

Solve the race by checking if we are root bridge before continuing.
This was the root cause of the cases where br_send_tcn_bpdu would OOPS.

Reported-by: JerryKang <jerry.kang@samsung.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

---
Patch against current net (for 3.10 merge window)
Should go to stable

--- a/net/bridge/br_stp_timer.c	2013-05-02 14:30:53.442556944 -0700
+++ b/net/bridge/br_stp_timer.c	2013-05-02 14:31:54.481765082 -0700
@@ -107,7 +107,7 @@ static void br_tcn_timer_expired(unsigne
 
 	br_debug(br, "tcn timer expired\n");
 	spin_lock(&br->lock);
-	if (br->dev->flags & IFF_UP) {
+	if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
 		br_transmit_tcn(br);
 
 		mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);

Re: [PATCH net] bridge: fix race with topology change timer

[David Miller]

From: Stephen Hemminger <stephen@networkplumber.org>
Date: Thu, 2 May 2013 17:23:28 -0700

> A bridge should only send topology change notice if it is not
> the root bridge. It is possible for message age timer to elect itself
> as a new root bridge, and still have a topology change timer running
> but waiting for bridge lock on other CPU.
> 
> Solve the race by checking if we are root bridge before continuing.
> This was the root cause of the cases where br_send_tcn_bpdu would OOPS.
> 
> Reported-by: JerryKang <jerry.kang@samsung.com>
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

Applied and queued up for -stable.