https://github.com/torvalds/linux
Revision 4dee959723e2bf3a0f9343a46841cd2f0029d424 authored by Pavel Emelyanov on 14 April 2008, 07:44:52 UTC, committed by David S. Miller on 14 April 2008, 07:44:52 UTC
Consider we are putting a clusterip_config entry with the "entries" count == 1, and on the other CPU there's a clusterip_config_find_get in progress: CPU1: CPU2: clusterip_config_entry_put: clusterip_config_find_get: if (atomic_dec_and_test(&c->entries)) { /* true */ read_lock_bh(&clusterip_lock); c = __clusterip_config_find(clusterip); /* found - it's still in list */ ... atomic_inc(&c->entries); read_unlock_bh(&clusterip_lock); write_lock_bh(&clusterip_lock); list_del(&c->list); write_unlock_bh(&clusterip_lock); ... dev_put(c->dev); Oops! We have an entry returned by the clusterip_config_find_get, which is a) not in list b) has a stale dev pointer. The problems will happen when the CPU2 will release the entry - it will remove it from the list for the 2nd time, thus spoiling it, and will put a stale dev pointer. The fix is to make atomic_dec_and_test under the clusterip_lock. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
1 parent 9625ed7
Tip revision: 4dee959723e2bf3a0f9343a46841cd2f0029d424 authored by Pavel Emelyanov on 14 April 2008, 07:44:52 UTC
[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
Tip revision: 4dee959
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
usr | ||
virt | ||
.gitignore | -rw-r--r-- | 644 bytes |
.mailmap | -rw-r--r-- | 3.6 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 90.4 KB |
Kbuild | -rw-r--r-- | 1.6 KB |
MAINTAINERS | -rw-r--r-- | 94.9 KB |
Makefile | -rw-r--r-- | 52.8 KB |
README | -rw-r--r-- | 16.5 KB |
REPORTING-BUGS | -rw-r--r-- | 3.1 KB |
Computing file changes ...