mac80211: Check size of a new mesh path table for changes since allocation.
authorJavier Cardona <javier@cozybit.com>
Tue, 3 May 2011 23:57:15 +0000 (16:57 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 11 May 2011 18:50:30 +0000 (14:50 -0400)
Not sure if I'm chasing a ghost here, seems like the
mesh_path->size_order needs to be inside an RCU-read section to prevent
that value from changing between table allocation and copying.  We have
observed crashes that might be caused by this.

Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/mac80211/mesh_pathtbl.c

index 7776ae5a8f15776d32699348d345c749b8d1b928..c1a2bf2aa2def82674d54635768ffc2f5969497e 100644 (file)
@@ -76,7 +76,6 @@ static int mesh_table_grow(struct mesh_table *oldtbl,
                        < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1))
                return -EAGAIN;
 
-
        newtbl->free_node = oldtbl->free_node;
        newtbl->mean_chain_len = oldtbl->mean_chain_len;
        newtbl->copy_node = oldtbl->copy_node;
@@ -329,7 +328,8 @@ void mesh_mpath_table_grow(void)
 {
        struct mesh_table *oldtbl, *newtbl;
 
-       newtbl = mesh_table_alloc(mesh_paths->size_order + 1);
+       rcu_read_lock();
+       newtbl = mesh_table_alloc(rcu_dereference(mesh_paths)->size_order + 1);
        if (!newtbl)
                return;
        write_lock(&pathtbl_resize_lock);
@@ -339,6 +339,7 @@ void mesh_mpath_table_grow(void)
                write_unlock(&pathtbl_resize_lock);
                return;
        }
+       rcu_read_unlock();
        rcu_assign_pointer(mesh_paths, newtbl);
        write_unlock(&pathtbl_resize_lock);
 
@@ -350,7 +351,8 @@ void mesh_mpp_table_grow(void)
 {
        struct mesh_table *oldtbl, *newtbl;
 
-       newtbl = mesh_table_alloc(mpp_paths->size_order + 1);
+       rcu_read_lock();
+       newtbl = mesh_table_alloc(rcu_dereference(mpp_paths)->size_order + 1);
        if (!newtbl)
                return;
        write_lock(&pathtbl_resize_lock);
@@ -360,6 +362,7 @@ void mesh_mpp_table_grow(void)
                write_unlock(&pathtbl_resize_lock);
                return;
        }
+       rcu_read_unlock();
        rcu_assign_pointer(mpp_paths, newtbl);
        write_unlock(&pathtbl_resize_lock);