• Patrick McHardy's avatar
    [BRIDGE]: Fix fdb RCU race · b19cbe2a
    Patrick McHardy authored
    br_fdb_get use atomic_inc to increase the refcount of an element found
    on a RCU protected list, which can lead to the following race:
    
    CPU0					CPU1
    
    					br_fdb_get:   rcu_read_lock
    					__br_fdb_get: find element
    fdb_delete:   hlist_del_rcu
    	      br_fdb_put
    br_fdb_put:   atomic_dec_and_test
    	      call_rcu(fdb_rcu_free)	br_fdb_get:   atomic_inc
    						      rcu_read_unlock
    fdb_rcu_free: kmem_cache_free
    
    Use atomic_inc_not_zero instead.
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b19cbe2a
br_fdb.c 8.62 KB