: Fix fdb RCU race

Fix what looks like a RCU race. Untested since this is only used by ATM, which I don't have.

[BRIDGE]: Fix fdb RCU race

br_fdb_get use atomic_inc to increase the refcount of an element found on a RCU protected list, which can lead to the following race:

CPU0 CPU1

br_fdb_get: rcu_read_lock
__br_fdb_get: find element
fdb_delete: hlist_del_rcu
br_fdb_put
br_fdb_put: atomic_dec_and_test
call_rcu(fdb_rcu_free) br_fdb_get: atomic_inc
rcu_read_unlock
fdb_rcu_free: kmem_cache_free

Use atomic_inc_not_zero instead.

---
commit 6965873e9db0cb3f9a8412bd541a5309dcfb6eb6
tree 152e90dc86fe96ca7cb8f0e280827920ddb62247
parent 8559840c4ca3f2fff73a882803bc8916078fac1f
author Patrick McHardy <[email protected]> Thu, 22 Mar 2007 19:20:08 +0100 committer Patrick McHardy <[email protected]> Thu, 22 Mar 2007 19:20:08 +0100

 net/bridge/br_fdb.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

index def2e40..8d566c1 100644
@@ -197,8 +197,8 @@ struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
 
 	rcu_read_lock();
 	fdb = __br_fdb_get(br, addr);
-	if (fdb)
-		atomic_inc(&fdb->use_count);
+	if (fdb && !atomic_inc_not_zero(&fdb->use_count))
+		fdb = NULL;
 	rcu_read_unlock();
 	return fdb;
 }

That looks right, I wonder if the ATM hooks ever get used?

Stephen Hemminger <[email protected]>

From: Patrick McHardy <[email protected]>
Date: Thu, 22 Mar 2007 19:29:09 +0100

Also applied, thanks Patrick.