diff options
author | Eric Dumazet <eric.dumazet@gmail.com> | 2013-06-28 02:37:42 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-07-28 16:29:44 -0700 |
commit | ac294f13d331cb3e315fd922ae505619f853818b (patch) | |
tree | 16a680f780feabd34c3222ba8d212f4f5b036d02 /net/x25 | |
parent | ce08aa04215ea3309c47677f55d3b52d31d6a97a (diff) |
neighbour: fix a race in neigh_destroy()
[ Upstream commit c9ab4d85de222f3390c67aedc9c18a50e767531e ]
There is a race in neighbour code, because neigh_destroy() uses
skb_queue_purge(&neigh->arp_queue) without holding neighbour lock,
while other parts of the code assume neighbour rwlock is what
protects arp_queue
Convert all skb_queue_purge() calls to the __skb_queue_purge() variant
Use __skb_queue_head_init() instead of skb_queue_head_init()
to make clear we do not use arp_queue.lock
And hold neigh->lock in neigh_destroy() to close the race.
Reported-by: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/x25')
0 files changed, 0 insertions, 0 deletions