Robert Shearman <rshea...@brocade.com> writes:
> The mpls device is used in an RCU read context without a lock being
> held. As the memory is freed without waiting for the RCU grace period
> to elapse, the freed memory could still be in use.
>
> Address this by using kfree_rcu to free the memory for the mpls device
> after the RCU grace period has elapsed.
Acked-by: "Eric W. Biederman" <ebied...@xmission.com>
> Fixes: 03c57747a702 ("mpls: Per-device MPLS state")
> Signed-off-by: Robert Shearman <rshea...@brocade.com>
> ---
> net/mpls/af_mpls.c | 2 +-
> net/mpls/internal.h | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
> index 7b3f732269e4..bff427f31924 100644
> --- a/net/mpls/af_mpls.c
> +++ b/net/mpls/af_mpls.c
> @@ -541,7 +541,7 @@ static void mpls_ifdown(struct net_device *dev)
>
> RCU_INIT_POINTER(dev->mpls_ptr, NULL);
>
> - kfree(mdev);
> + kfree_rcu(mdev, rcu);
> }
>
> static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
> diff --git a/net/mpls/internal.h b/net/mpls/internal.h
> index b064c345042c..8cabeb5a1cb9 100644
> --- a/net/mpls/internal.h
> +++ b/net/mpls/internal.h
> @@ -16,6 +16,7 @@ struct mpls_dev {
> int input_enabled;
>
> struct ctl_table_header *sysctl;
> + struct rcu_head rcu;
> };
>
> struct sk_buff;
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
