diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-12-06 09:29:43 -0800 |
|---|---|---|
| committer | AK <andi@firstfloor.org> | 2011-02-06 11:03:38 -0800 |
| commit | 10cac669d7b9bad2207c2d63619fb265f8cb6486 (patch) | |
| tree | 48989da7c82f5f82c3abb7e68a77391a10d9650c /include | |
| parent | 9b8a00c1f467735fbead2228f331a1182c9bb643 (diff) | |
filter: fix sk_filter rcu handling
[ Upstream commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 ]
Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and
sk_clone() in commit 47e958eac280c263397
Problem is we can have several clones sharing a common sk_filter, and
these clones might want to sk_filter_attach() their own filters at the
same time, and can overwrite old_filter->rcu, corrupting RCU queues.
We can not use filter->rcu without being sure no other thread could do
the same thing.
Switch code to a more conventional ref-counting technique : Do the
atomic decrement immediately and queue one rcu call back when last
reference is released.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/sock.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index e2a9f591a0e3..a4089b3500a0 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1151,6 +1151,8 @@ extern void sk_common_release(struct sock *sk); /* Initialise core socket variables */ extern void sock_init_data(struct socket *sock, struct sock *sk); +extern void sk_filter_release_rcu(struct rcu_head *rcu); + /** * sk_filter_release - release a socket filter * @fp: filter to remove @@ -1161,7 +1163,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk); static inline void sk_filter_release(struct sk_filter *fp) { if (atomic_dec_and_test(&fp->refcnt)) - kfree(fp); + call_rcu_bh(&fp->rcu, sk_filter_release_rcu); } static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp) |