From patchwork Tue Feb 3 20:33:22 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 436019 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C659D1401DE for ; Wed, 4 Feb 2015 07:33:36 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161155AbbBCUda (ORCPT ); Tue, 3 Feb 2015 15:33:30 -0500 Received: from helcar.apana.org.au ([209.40.204.226]:57608 "EHLO helcar.apana.org.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161144AbbBCUd2 (ORCPT ); Tue, 3 Feb 2015 15:33:28 -0500 Received: from gondolin.me.apana.org.au ([192.168.0.6]) by norbury.hengli.com.au with esmtp (Exim 4.80 #3 (Debian)) id 1YIk9y-0007pH-WB; Wed, 04 Feb 2015 07:33:23 +1100 Received: from herbert by gondolin.me.apana.org.au with local (Exim 4.80) (envelope-from ) id 1YIk9y-00062w-3E; Wed, 04 Feb 2015 07:33:22 +1100 Subject: [PATCH 1/4] rhashtable: Fix potential crash on destroy in rhashtable_shrink References: <20150203203213.GA23177@gondor.apana.org.au> To: David Miller , tgraf@suug.ch, netdev@vger.kernel.org Message-Id: From: Herbert Xu Date: Wed, 04 Feb 2015 07:33:22 +1100 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The current being_destroyed check in rhashtable_expand is not enough since if we start a shrinking process after freeing all elements in the table that's also going to crash. This patch adds a being_destroyed check to the deferred worker thread so that we bail out as soon as we take the lock. Signed-off-by: Herbert Xu --- lib/rhashtable.c | 4 ++++ 1 file changed, 4 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/lib/rhashtable.c b/lib/rhashtable.c index c41e210..904b419 100644 --- a/lib/rhashtable.c +++ b/lib/rhashtable.c @@ -487,6 +487,9 @@ static void rht_deferred_worker(struct work_struct *work) ht = container_of(work, struct rhashtable, run_work); mutex_lock(&ht->mutex); + if (ht->being_destroyed) + goto unlock; + tbl = rht_dereference(ht->tbl, ht); if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size)) @@ -494,6 +497,7 @@ static void rht_deferred_worker(struct work_struct *work) else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size)) rhashtable_shrink(ht); +unlock: mutex_unlock(&ht->mutex); }