diff options
author | Pavel Emelyanov <xemul@openvz.org> | 2008-01-10 03:48:38 -0800 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-01-10 03:48:38 -0800 |
commit | 9cd40029423701c376391da59d2c6469672b4bed (patch) | |
tree | a49624a361ab9c28879efc68862aee819538e9bc /net/rfkill | |
parent | b0de8e402dc5d3ee04f4d0f669ae492a3e569933 (diff) |
[NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms
The neightbl_fill_parms() is called under the write-locked tbl->lock
and accesses the parms->dev. The negh_parm_release() calls the
dev_put(parms->dev) without this lock. This creates a tiny race window
on which the parms contains potentially stale dev pointer.
To fix this race it's enough to move the dev_put() upper under the
tbl->lock, but note, that the parms are held by neighbors and thus can
live after the neigh_parms_release() is called, so we still can have a
parm with bad dev pointer.
I didn't find where the neigh->parms->dev is accessed, but still think
that putting the dev is to be done in a place, where the parms are
really freed. Am I right with that?
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rfkill')
0 files changed, 0 insertions, 0 deletions