leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

packet: free packet_rollover after synchronize_net

Browse Source 
Destruction of the po->rollover must be delayed until there are no
more packets in flight that can access it. The field is destroyed in
packet_release, before synchronize_net. Delay using rcu.

Fixes: 0648ab70af ("packet: rollover prepare: per-socket state")

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Willem de Bruijn 2015-06-16 12:51:37 -04:00 committed by David S. Miller
parent 120119623b
commit 59f211181b
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/packet/af_packet.c
View File

@ -1634,7 +1634,8 @@ static void fanout_release(struct sock *sk)
}
mutex_unlock(&fanout_mutex);
kfree(po->rollover);
if (po->rollover)
kfree_rcu(po->rollover, rcu);
}
static const struct proto_ops packet_ops;

1
net/packet/internal.h
View File

@ -89,6 +89,7 @@ struct packet_fanout {
struct packet_rollover {
int sock;
struct rcu_head rcu;
atomic_long_t num;
atomic_long_t num_huge;
atomic_long_t num_failed;