[PATCH] Fix dst_destroy() race

6775cab9 · Herbert Xu <[email protected]> · 2005-04-16 15:24:10 -07:00

When we are not the real parent of the dst (e.g., when we're xfrm_dst and
the child is an rtentry), it may already be on the GC list.

In fact the current code is buggy to, we need to check dst->flags before
the dec as dst may no longer be valid afterwards.

Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: 6775cab98b89b2caa10dce4b07e2c81999e45517
Parents: 2a278051

Changes

1 files changed · +4 −2

File	Status	Add	Del	Content
net/core/dst.c	modified	+4	−2	View file

net/core/dst.c

View file

diff --git a/net/core/dst.c b/net/core/dst.c
index 3bf6cc4..fc434ad 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -198,13 +198,15 @@ again:
 
 	dst = child;
 	if (dst) {
+		int nohash = dst->flags & DST_NOHASH;
+
 		if (atomic_dec_and_test(&dst->__refcnt)) {
 			/* We were real parent of this dst, so kill child. */
-			if (dst->flags&DST_NOHASH)
+			if (nohash)
 				goto again;
 		} else {
 			/* Child is still referenced, return it for freeing. */
-			if (dst->flags&DST_NOHASH)
+			if (nohash)
 				return dst;
 			/* Child is still in his hash table */
 		}