diff options
| author | Pavel Emelyanov <xemul@openvz.org> | 2007-10-17 21:22:42 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-10-17 21:22:42 -0700 |
| commit | 47e958eac280c263397582d5581e868c3227a1bd (patch) | |
| tree | 67fc50a26b7861b3330eae7f1874df851c0ef740 /include/net | |
| parent | d3904b739928edd83d117f1eb5bfa69f18d6f046 (diff) | |
| download | linux-47e958eac280c263397582d5581e868c3227a1bd.tar.bz2 | |
[NET]: Fix the race between sk_filter_(de|at)tach and sk_clone()
The proposed fix is to delay the reference counter decrement
until the quiescent state pass. This will give sk_clone() a
chance to get the reference on the cloned filter.
Regular sk_filter_uncharge can happen from the sk_free() only
and there's no need in delaying the put - the socket is dead
anyway and is to be release itself.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/sock.h | 12 |
1 files changed, 1 insertions, 11 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index b9cfe125c9e6..43fc3fa50d62 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -905,16 +905,6 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb) } /** - * sk_filter_rcu_free: Free a socket filter - * @rcu: rcu_head that contains the sk_filter to free - */ -static inline void sk_filter_rcu_free(struct rcu_head *rcu) -{ - struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu); - kfree(fp); -} - -/** * sk_filter_release: Release a socket filter * @sk: socket * @fp: filter to remove @@ -925,7 +915,7 @@ static inline void sk_filter_rcu_free(struct rcu_head *rcu) static inline void sk_filter_release(struct sk_filter *fp) { if (atomic_dec_and_test(&fp->refcnt)) - call_rcu_bh(&fp->rcu, sk_filter_rcu_free); + kfree(fp); } static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp) |