From cfbe800b8b771afc7d5aa113e19f85ec933b7618 Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Tue, 2 Apr 2013 21:52:40 +0000 Subject: 802: fix a possible race condition (Resend with a better changelog) garp_pdu_queue() should ways be called with this spin lock. garp_uninit_applicant() only holds rtnl lock which is not enough here. A possible race can happen as garp_pdu_rcv() is called in BH context: garp_pdu_rcv() |->garp_pdu_parse_msg() |->garp_pdu_parse_attr() |-> garp_gid_event() Found by code inspection. Cc: Eric Dumazet Cc: "David S. Miller" Cc: David Ward Cc: "Jorge Boncompte [DTI2]" Signed-off-by: Cong Wang Signed-off-by: David S. Miller --- net/802/garp.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'net/802') diff --git a/net/802/garp.c b/net/802/garp.c index 8456f5d98b8..5d9630a0eb9 100644 --- a/net/802/garp.c +++ b/net/802/garp.c @@ -609,8 +609,12 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl /* Delete timer and generate a final TRANSMIT_PDU event to flush out * all pending messages before the applicant is gone. */ del_timer_sync(&app->join_timer); + + spin_lock_bh(&app->lock); garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); garp_pdu_queue(app); + spin_unlock_bh(&app->lock); + garp_queue_xmit(app); dev_mc_del(dev, appl->proto.group_address); -- cgit v1.2.3-70-g09d2