summaryrefslogtreecommitdiff
path: root/net/bridge
diff options
context:
space:
mode:
authorstephen hemminger <shemminger@vyatta.com>2010-04-27 15:01:06 +0000
committerDavid S. Miller <davem@davemloft.net>2010-04-27 18:13:54 -0700
commit83f6a740b4e52f88e312223df2fc94016a208618 (patch)
tree7cb24cc5a3a5779fe3dd9fbba3351cac19062b1f /net/bridge
parent168d40ee3d147ae20860e7916bd79b636cbe8fd5 (diff)
bridge: multicast port group RCU fix
The recently introduced bridge mulitcast port group list was only partially using RCU correctly. It was missing rcu_dereference() and missing the necessary barrier on deletion. The code should have used one of the standard list methods (list or hlist) instead of open coding a RCU based link list. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
-rw-r--r--net/bridge/br_forward.c4
-rw-r--r--net/bridge/br_multicast.c2
2 files changed, 3 insertions, 3 deletions
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 5b70fc012e40..5f9988a3f06a 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -217,7 +217,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
prev = NULL;
rp = rcu_dereference(br->router_list.first);
- p = mdst ? mdst->ports : NULL;
+ p = mdst ? rcu_dereference(mdst->ports) : NULL;
while (p || rp) {
lport = p ? p->port : NULL;
rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
@@ -231,7 +231,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
goto out;
if ((unsigned long)lport >= (unsigned long)port)
- p = p->next;
+ p = rcu_dereference(p->next);
if ((unsigned long)rport >= (unsigned long)port)
rp = rcu_dereference(rp->next);
}
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index d63868c9b2c0..7128abdce45f 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -259,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
if (p != pg)
continue;
- *pp = p->next;
+ rcu_assign_pointer(*pp, p->next);
hlist_del_init(&p->mglist);
del_timer(&p->timer);
del_timer(&p->query_timer);