Commit 4d81db41 authored Jun 12, 2015 by Scott Feldman Committed by David S. Miller Jun 15, 2015

rocker: fix neigh tbl index increment race



rocker->neigh_tbl_next_index is used to generate unique indices for neigh
entries programmed into the device.  The way new indices were generated was
racy with the new prepare-commit transaction model.  A simple fix here
removes the race.  The race was with two processes getting the same index,
one process using prepare-commit, the other not:

Proc A					Proc B

PREPARE phase
get neigh_tbl_next_index

					NONE phase
					get neigh_tbl_next_index
					neigh_tbl_next_index++

COMMIT phase
neigh_tbl_next_index++

Both A and B got the same index.  The fix is to store and increment
neigh_tbl_next_index in the PREPARE (or NONE) phase and use value in COMMIT
phase:

Proc A					Proc B

PREPARE phase
get neigh_tbl_next_index
neigh_tbl_next_index++

					NONE phase
					get neigh_tbl_next_index
					neigh_tbl_next_index++

COMMIT phase
// use value stashed in PREPARE phase

Reported-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Scott Feldman <sfeldma@gmail.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a0720310

drivers/net/ethernet/rocker/rocker.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -2901,10 +2901,10 @@ static void _rocker_neigh_add(struct rocker *rocker,
	enum switchdev_trans trans,		enum switchdev_trans trans,
	struct rocker_neigh_tbl_entry *entry)		struct rocker_neigh_tbl_entry *entry)
	{		{
	entry->index = rocker->neigh_tbl_next_index;		if (trans != SWITCHDEV_TRANS_COMMIT)
			entry->index = rocker->neigh_tbl_next_index++;
	if (trans == SWITCHDEV_TRANS_PREPARE)		if (trans == SWITCHDEV_TRANS_PREPARE)
	return;		return;
	rocker->neigh_tbl_next_index++;
	entry->ref_count++;		entry->ref_count++;
	hash_add(rocker->neigh_tbl, &entry->entry,		hash_add(rocker->neigh_tbl, &entry->entry,
	be32_to_cpu(entry->ip_addr));		be32_to_cpu(entry->ip_addr));