From patchwork Sat Oct 11 11:17:11 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: pkt_sched: cls_u32: Fix locking in u32_delete() From: Jarek Poplawski X-Patchwork-Id: 4004 Message-Id: <20081011111711.GA2808@ami.dom.local> To: David Miller Cc: netdev@vger.kernel.org, bugme-daemon@bugzilla.kernel.org, m0sia@plotinka.ru, Andrew Morton Date: Sat, 11 Oct 2008 13:17:11 +0200 pkt_sched: cls_u32: Fix locking in u32_delete() While looking for a possible reason of bugzilla [Bug 11571] "u32_classify Kernel Panic" reported by m0sia@plotinka.ru I found that tcf_tree_lock() is missing in u32_delete() during u32_destroy_hnode() call. Other paths calling this function use this lock. It haven't been acknowledged this fixes the bug, but I think this patch is needed here anyway. Signed-off-by: Jarek Poplawski --- net/sched/cls_u32.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 246f906..9912ad5 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -433,7 +433,9 @@ static int u32_delete(struct tcf_proto *tp, unsigned long arg) if (ht->refcnt == 1) { ht->refcnt--; + tcf_tree_lock(tp); u32_destroy_hnode(tp, ht); + tcf_tree_unlock(tp); } else { return -EBUSY; }