path: root/net/ipv4/inetpeer.c
diff options
authorEric Dumazet <edumazet@google.com>2017-09-01 14:03:32 -0700
committerDavid S. Miller <davem@davemloft.net>2017-09-01 17:33:17 -0700
commit4cc5b44b29a9de9b3f841efedaa3f769066c63cc (patch)
tree2a98212b93c7c09a10a29c57754f3bc8cde99627 /net/ipv4/inetpeer.c
parentselftests: correct define in msg_zerocopy.c (diff)
inetpeer: fix RCU lookup()
Excess of seafood or something happened while I cooked the commit adding RB tree to inetpeer. Of course, RCU rules need to be respected or bad things can happen. In this particular loop, we need to read *pp once per iteration, not twice. Fixes: b145425f269a ("inetpeer: remove AVL implementation in favor of RB tree") Reported-by: John Sperbeck <jsperbeck@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/inetpeer.c')
1 files changed, 6 insertions, 3 deletions
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 337ad41bb80a..e7eb590c86ce 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -102,15 +102,18 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
struct rb_node **parent_p,
struct rb_node ***pp_p)
- struct rb_node **pp, *parent;
+ struct rb_node **pp, *parent, *next;
struct inet_peer *p;
pp = &base->rb_root.rb_node;
parent = NULL;
- while (*pp) {
+ while (1) {
int cmp;
- parent = rcu_dereference_raw(*pp);
+ next = rcu_dereference_raw(*pp);
+ if (!next)
+ break;
+ parent = next;
p = rb_entry(parent, struct inet_peer, rb_node);
cmp = inetpeer_addr_cmp(daddr, &p->daddr);
if (cmp == 0) {