Commit 28134a53 authored Feb 04, 2015 by Herbert Xu Committed by David S. Miller Feb 04, 2015

rhashtable: Fix potential crash on destroy in rhashtable_shrink



The current being_destroyed check in rhashtable_expand is not
enough since if we start a shrinking process after freeing all
elements in the table that's also going to crash.

This patch adds a being_destroyed check to the deferred worker
thread so that we bail out as soon as we take the lock.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 9b55669c

lib/rhashtable.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -487,6 +487,9 @@ static void rht_deferred_worker(struct work_struct *work)

		ht = container_of(work, struct rhashtable, run_work);
		mutex_lock(&ht->mutex);
		if (ht->being_destroyed)
		goto unlock;

		tbl = rht_dereference(ht->tbl, ht);

		if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size))
		@@ -494,6 +497,7 @@ static void rht_deferred_worker(struct work_struct *work)
		else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size))
		rhashtable_shrink(ht);

		unlock:
		mutex_unlock(&ht->mutex);
		}