From patchwork Tue May 3 23:57:15 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Cardona X-Patchwork-Id: 752322 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p43NvmTC031211 for ; Tue, 3 May 2011 23:57:49 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754088Ab1ECX5q (ORCPT ); Tue, 3 May 2011 19:57:46 -0400 Received: from mail-px0-f170.google.com ([209.85.212.170]:51390 "EHLO mail-px0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753938Ab1ECX5n (ORCPT ); Tue, 3 May 2011 19:57:43 -0400 Received: by mail-px0-f170.google.com with SMTP id 19so426563pxi.1 for ; Tue, 03 May 2011 16:57:43 -0700 (PDT) Received: by 10.68.50.65 with SMTP id a1mr618530pbo.353.1304467063194; Tue, 03 May 2011 16:57:43 -0700 (PDT) Received: from localhost.localdomain ([99.8.184.170]) by mx.google.com with ESMTPS id z3sm344013pbk.55.2011.05.03.16.57.41 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 03 May 2011 16:57:42 -0700 (PDT) From: Javier Cardona To: "John W. Linville" Cc: Javier Cardona , Thomas Pedersen , devel@lists.open80211s.org, Johannes Berg , linux-wireless@vger.kernel.org, jlopex@gmail.com Subject: [PATCH 09/13] Check size of a new mesh path table for changes since allocation. Date: Tue, 3 May 2011 16:57:15 -0700 Message-Id: <1304467039-7730-10-git-send-email-javier@cozybit.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1304467039-7730-1-git-send-email-javier@cozybit.com> References: <1304467039-7730-1-git-send-email-javier@cozybit.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Tue, 03 May 2011 23:57:52 +0000 (UTC) Not sure if I'm chasing a ghost here, seems like the mesh_path->size_order needs to be inside an RCU-read section to prevent that value from changing between table allocation and copying. We have observed crashes that might be caused by this. Signed-off-by: Javier Cardona --- net/mac80211/mesh_pathtbl.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index 35c715a..d4e86fd 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -76,7 +76,6 @@ static int mesh_table_grow(struct mesh_table *oldtbl, < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1)) return -EAGAIN; - newtbl->free_node = oldtbl->free_node; newtbl->mean_chain_len = oldtbl->mean_chain_len; newtbl->copy_node = oldtbl->copy_node; @@ -329,7 +328,8 @@ void mesh_mpath_table_grow(void) { struct mesh_table *oldtbl, *newtbl; - newtbl = mesh_table_alloc(mesh_paths->size_order + 1); + rcu_read_lock(); + newtbl = mesh_table_alloc(rcu_dereference(mesh_paths)->size_order + 1); if (!newtbl) return; write_lock(&pathtbl_resize_lock); @@ -339,6 +339,7 @@ void mesh_mpath_table_grow(void) write_unlock(&pathtbl_resize_lock); return; } + rcu_read_unlock(); rcu_assign_pointer(mesh_paths, newtbl); write_unlock(&pathtbl_resize_lock); @@ -350,7 +351,8 @@ void mesh_mpp_table_grow(void) { struct mesh_table *oldtbl, *newtbl; - newtbl = mesh_table_alloc(mpp_paths->size_order + 1); + rcu_read_lock(); + newtbl = mesh_table_alloc(rcu_dereference(mpp_paths)->size_order + 1); if (!newtbl) return; write_lock(&pathtbl_resize_lock); @@ -360,6 +362,7 @@ void mesh_mpp_table_grow(void) write_unlock(&pathtbl_resize_lock); return; } + rcu_read_unlock(); rcu_assign_pointer(mpp_paths, newtbl); write_unlock(&pathtbl_resize_lock);