summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Ward <david.ward@ll.mit.edu>2013-04-11 13:47:15 +0000
committerDavid S. Miller <davem@davemloft.net>2013-04-12 15:10:48 -0400
commitfb745e9a037895321781d066aa24757ceabf9df9 (patch)
tree1166ef2a488b5e1afbd1ee71df493fb593adf167
parent3be8fbab18fbc06b6ff94a56f9c225e29ea64a73 (diff)
downloadlinux-fb745e9a037895321781d066aa24757ceabf9df9.tar.bz2
net/802/mrp: fix possible race condition when calling mrp_pdu_queue()
(Adapted from a very similar change to net/802/garp.c by Cong Wang.) mrp_pdu_queue() should ways be called with the applicant spin lock. mrp_uninit_applicant() only holds the rtnl lock which is not enough; a race is possible because mrp_rcv() is called in BH context: mrp_rcv() |->mrp_pdu_parse_msg() |->mrp_pdu_parse_vecattr() |->mrp_pdu_parse_vecattr_event() |-> mrp_attr_event() |-> mrp_pdu_append_vecattr_event() |-> mrp_pdu_queue() Cc: Cong Wang <amwang@redhat.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David Ward <david.ward@ll.mit.edu> Acked-by: Cong Wang <amwang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/802/mrp.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/802/mrp.c b/net/802/mrp.c
index a4cc3229952a..e085bcc754f6 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -870,8 +870,12 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
* all pending messages before the applicant is gone.
*/
del_timer_sync(&app->join_timer);
+
+ spin_lock(&app->lock);
mrp_mad_event(app, MRP_EVENT_TX);
mrp_pdu_queue(app);
+ spin_unlock(&app->lock);
+
mrp_queue_xmit(app);
dev_mc_del(dev, appl->group_address);