Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83f6a740 authored by stephen hemminger's avatar stephen hemminger Committed by David S. Miller
Browse files

bridge: multicast port group RCU fix 



The recently introduced bridge mulitcast port group list was only
partially using RCU correctly. It was missing rcu_dereference()
and missing the necessary barrier on deletion.

The code should have used one of the standard list methods (list or hlist)
instead of open coding a RCU based link list.

Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 168d40ee

net/bridge/br_forward.c

+2 −2
Original line number Diff line number Diff line
@@ -217,7 +217,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, 
	prev = NULL;



	rp = rcu_dereference(br->router_list.first);

	p = mdst ? mdst->ports : NULL;

	p = mdst ? rcu_dereference(mdst->ports) : NULL;

	while (p || rp) {

		lport = p ? p->port : NULL;

		rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
@@ -231,7 +231,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, 
			goto out;



		if ((unsigned long)lport >= (unsigned long)port)

			p = p->next;

			p = rcu_dereference(p->next);

		if ((unsigned long)rport >= (unsigned long)port)

			rp = rcu_dereference(rp->next);

	}

net/bridge/br_multicast.c

+1 −1
Original line number Diff line number Diff line
@@ -259,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br, 
		if (p != pg)

			continue;



		*pp = p->next;

		rcu_assign_pointer(*pp, p->next);

		hlist_del_init(&p->mglist);

		del_timer(&p->timer);

		del_timer(&p->query_timer);