diff options
| author | stephen hemminger <shemminger@vyatta.com> | 2010-04-27 15:01:06 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-04-27 18:13:54 -0700 |
| commit | 83f6a740b4e52f88e312223df2fc94016a208618 (patch) | |
| tree | 7cb24cc5a3a5779fe3dd9fbba3351cac19062b1f /net/bridge | |
| parent | 168d40ee3d147ae20860e7916bd79b636cbe8fd5 (diff) | |
bridge: multicast port group RCU fix
The recently introduced bridge mulitcast port group list was only
partially using RCU correctly. It was missing rcu_dereference()
and missing the necessary barrier on deletion.
The code should have used one of the standard list methods (list or hlist)
instead of open coding a RCU based link list.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
| -rw-r--r-- | net/bridge/br_forward.c | 4 | ||||
| -rw-r--r-- | net/bridge/br_multicast.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c index 5b70fc012e4..5f9988a3f06 100644 --- a/net/bridge/br_forward.c +++ b/net/bridge/br_forward.c @@ -217,7 +217,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, prev = NULL; rp = rcu_dereference(br->router_list.first); - p = mdst ? mdst->ports : NULL; + p = mdst ? rcu_dereference(mdst->ports) : NULL; while (p || rp) { lport = p ? p->port : NULL; rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) : @@ -231,7 +231,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, goto out; if ((unsigned long)lport >= (unsigned long)port) - p = p->next; + p = rcu_dereference(p->next); if ((unsigned long)rport >= (unsigned long)port) rp = rcu_dereference(rp->next); } diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index d63868c9b2c..7128abdce45 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -259,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br, if (p != pg) continue; - *pp = p->next; + rcu_assign_pointer(*pp, p->next); hlist_del_init(&p->mglist); del_timer(&p->timer); del_timer(&p->query_timer); |