Message ID | 1431672946-300-6-git-send-email-ying.xue@windriver.com |
---|---|
State | Rejected, archived |
Delegated to: | David Miller |
Headers | show |
diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 8a438fc..67a0e42 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -687,9 +687,11 @@ void neigh_destroy(struct neighbour *neigh) NEIGH_CACHE_STAT_INC(neigh->tbl, destroys); + write_lock_bh(&neigh->lock); if (!neigh->dead) { pr_warn("Destroying alive neighbour %p\n", neigh); dump_stack(); + write_unlock_bh(&neigh->lock); return; } @@ -698,7 +700,6 @@ void neigh_destroy(struct neighbour *neigh) dump_stack(); } - write_lock_bh(&neigh->lock); __skb_queue_purge(&neigh->arp_queue); write_unlock_bh(&neigh->lock); neigh->arp_queue_len_bytes = 0;
As neigh lock is not taken before its variables like dead and timer are used in neigh_destroy(), this is unsafe for us. The commit allows neigh lock to cover all area of using them. Signed-off-by: Ying Xue <ying.xue@windriver.com> --- net/core/neighbour.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)