diff options
author | Tom Herbert <tom@herbertland.com> | 2015-08-05 09:39:27 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2015-08-07 15:56:56 -0700 |
commit | 10e4ea75149d11883a9e04c3b32ee1d7600d481e (patch) | |
tree | 4cf760912a8c9e3447619d6cdaeeac0835e9eaae /net/core/net-sysfs.c | |
parent | e05176a3283822bd32a1f3d929ce2050232299a8 (diff) |
net: Fix race condition in store_rps_map
There is a race condition in store_rps_map that allows jump label
count in rps_needed to go below zero. This can happen when
concurrently attempting to set and a clear map.
Scenario:
1. rps_needed count is zero
2. New map is assigned by setting thread, but rps_needed count _not_ yet
incremented (rps_needed count still zero)
2. Map is cleared by second thread, old_map set to that just assigned
3. Second thread performs static_key_slow_dec, rps_needed count now goes
negative
Fix is to increment or decrement rps_needed under the spinlock.
Signed-off-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/net-sysfs.c')
-rw-r--r-- | net/core/net-sysfs.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 194c1d03b2b3..39ec6949c1e6 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -726,14 +726,17 @@ static ssize_t store_rps_map(struct netdev_rx_queue *queue, old_map = rcu_dereference_protected(queue->rps_map, lockdep_is_held(&rps_map_lock)); rcu_assign_pointer(queue->rps_map, map); - spin_unlock(&rps_map_lock); if (map) static_key_slow_inc(&rps_needed); - if (old_map) { - kfree_rcu(old_map, rcu); + if (old_map) static_key_slow_dec(&rps_needed); - } + + spin_unlock(&rps_map_lock); + + if (old_map) + kfree_rcu(old_map, rcu); + free_cpumask_var(mask); return len; } |