Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb745e9a authored by David Ward's avatar David Ward Committed by David S. Miller
Browse files

net/802/mrp: fix possible race condition when calling mrp_pdu_queue() 



(Adapted from a very similar change to net/802/garp.c by Cong Wang.)

mrp_pdu_queue() should ways be called with the applicant spin lock.
mrp_uninit_applicant() only holds the rtnl lock which is not enough;
a race is possible because mrp_rcv() is called in BH context:

	mrp_rcv()
	  |->mrp_pdu_parse_msg()
	    |->mrp_pdu_parse_vecattr()
	      |->mrp_pdu_parse_vecattr_event()
	        |-> mrp_attr_event()
	          |-> mrp_pdu_append_vecattr_event()
	            |-> mrp_pdu_queue()

Cc: Cong Wang <amwang@redhat.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid Ward <david.ward@ll.mit.edu>
Acked-by: default avatarCong Wang <amwang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3be8fbab

net/802/mrp.c

+4 −0
Original line number Diff line number Diff line
@@ -870,8 +870,12 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl) 
	 * all pending messages before the applicant is gone.

	 */

	del_timer_sync(&app->join_timer);



	spin_lock(&app->lock);

	mrp_mad_event(app, MRP_EVENT_TX);

	mrp_pdu_queue(app);

	spin_unlock(&app->lock);



	mrp_queue_xmit(app);



	dev_mc_del(dev, appl->group_address);