diff options
| author |   Stephen Hemminger <shemminger@vyatta.com> | 2012-08-14 08:19:33 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2012-08-15 15:09:41 -0700 |
| commit | c03307eab68d583ea6db917681afa14ed1fb3b84 (patch) | |
| tree | d2480b2fd892254e7a37b5b757be6f2c40c2ca6b /net/atm/common.c | |
| parent | Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (diff) | |
| download | linux-dev-c03307eab68d583ea6db917681afa14ed1fb3b84.tar.xz linux-dev-c03307eab68d583ea6db917681afa14ed1fb3b84.zip | |
bridge: fix rcu dereference outside of rcu_read_lock
Alternative solution for problem found by Linux Driver Verification
project (linuxtesting.org).
As it noted in the comment before the br_handle_frame_finish
function, this function should be called under rcu_read_lock.
The problem callgraph:
br_dev_xmit -> br_nf_pre_routing_finish_bridge_slow ->
-> br_handle_frame_finish -> br_port_get_rcu -> rcu_dereference
And in this case there is no read-lock section.
Reported-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm/common.c')
0 files changed, 0 insertions, 0 deletions