neighbour: Fixed race condition at tbl->nht
authorMichel Machado <michel@digirati.com.br>
Tue, 21 Feb 2012 21:04:13 +0000 (16:04 -0500)
committerDavid S. Miller <davem@davemloft.net>
Tue, 21 Feb 2012 21:28:10 +0000 (16:28 -0500)
commit84338a6c9dbb6ff3de4749864020f8f25d86fc81
tree100409d99686fa989c64d4f5aa12721a3fafa5d8
parent3d8f93083be54696d3b7f8e8c6c70d411d01f9e8
neighbour: Fixed race condition at tbl->nht

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado <michel@digirati.com.br>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/neighbour.c