Commit 6775cab9 authored by Herbert Xu's avatar Herbert Xu Committed by Linus Torvalds

[PATCH] Fix dst_destroy() race

When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.

In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 2a278051
...@@ -198,13 +198,15 @@ again: ...@@ -198,13 +198,15 @@ again:
dst = child; dst = child;
if (dst) { if (dst) {
int nohash = dst->flags & DST_NOHASH;
if (atomic_dec_and_test(&dst->__refcnt)) { if (atomic_dec_and_test(&dst->__refcnt)) {
/* We were real parent of this dst, so kill child. */ /* We were real parent of this dst, so kill child. */
if (dst->flags&DST_NOHASH) if (nohash)
goto again; goto again;
} else { } else {
/* Child is still referenced, return it for freeing. */ /* Child is still referenced, return it for freeing. */
if (dst->flags&DST_NOHASH) if (nohash)
return dst; return dst;
/* Child is still in his hash table */ /* Child is still in his hash table */
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment