From: Pavel Emelyanov Date: Thu, 10 Jan 2008 11:48:38 +0000 (-0800) Subject: [NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms X-Git-Tag: v2.6.24-rc8~7^2~12 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9cd40029423701c376391da59d2c6469672b4bed;p=pandora-kernel.git [NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms The neightbl_fill_parms() is called under the write-locked tbl->lock and accesses the parms->dev. The negh_parm_release() calls the dev_put(parms->dev) without this lock. This creates a tiny race window on which the parms contains potentially stale dev pointer. To fix this race it's enough to move the dev_put() upper under the tbl->lock, but note, that the parms are held by neighbors and thus can live after the neigh_parms_release() is called, so we still can have a parm with bad dev pointer. I didn't find where the neigh->parms->dev is accessed, but still think that putting the dev is to be done in a place, where the parms are really freed. Am I right with that? Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller --- Reading git-diff-tree failed