Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd3d664f authored by Eric Dumazet's avatar Eric Dumazet Committed by Linus Torvalds
Browse files

percpu_counter: fix CPU unplug race in percpu_counter_destroy() 



We should first delete the counter from percpu_counters list
before freeing memory, or a percpu_counter_hotcpu_callback()
could dereference a NULL pointer.

Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mingming Cao <cmm@us.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent fe102c71

lib/percpu_counter.c

+2 −2
Original line number Diff line number Diff line
@@ -104,13 +104,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc) 
	if (!fbc->counters)

		return;



	free_percpu(fbc->counters);

	fbc->counters = NULL;

#ifdef CONFIG_HOTPLUG_CPU

	mutex_lock(&percpu_counters_lock);

	list_del(&fbc->list);

	mutex_unlock(&percpu_counters_lock);

#endif

	free_percpu(fbc->counters);

	fbc->counters = NULL;

}

EXPORT_SYMBOL(percpu_counter_destroy);