aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2005-04-16 15:24:10 -0700
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 15:24:10 -0700
commit6775cab98b89b2caa10dce4b07e2c81999e45517 (patch)
treec24ede63d9f2eb303744d5c96c8f5294cee3c1db
parent2a27805127aee1e7e62854bcf9ca8c355c23b73e (diff)
[PATCH] Fix dst_destroy() race
When we are not the real parent of the dst (e.g., when we're xfrm_dst and the child is an rtentry), it may already be on the GC list. In fact the current code is buggy to, we need to check dst->flags before the dec as dst may no longer be valid afterwards. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--net/core/dst.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/core/dst.c b/net/core/dst.c
index 3bf6cc43481..fc434ade527 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -198,13 +198,15 @@ again:
dst = child;
if (dst) {
+ int nohash = dst->flags & DST_NOHASH;
+
if (atomic_dec_and_test(&dst->__refcnt)) {
/* We were real parent of this dst, so kill child. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
goto again;
} else {
/* Child is still referenced, return it for freeing. */
- if (dst->flags&DST_NOHASH)
+ if (nohash)
return dst;
/* Child is still in his hash table */
}