lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tipc: Fix race condition when creating socket or native port

Browse Source 
This patch eliminates the (very remote) chance of a crash resulting
from a partially initialized socket or native port unexpectedly
receiving a message.  Now, during the creation of a socket or native
port, the underlying generic port's lock is not released until all
initialization required to handle incoming messages has been done.

Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Allan Stephens
2008-05-12 15:42:28 -07:00
committed by David S. Miller
parent 4e3e6dcb43
commit 7ef43ebaa5
5 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
net/tipc/ref.c
View File

@@ -142,9 +142,13 @@ void tipc_ref_table_stop(void)
/**
* tipc_ref_acquire - create reference to an object
*
* Return a unique reference value which can be translated back to the pointer
* 'object' at a later time. Also, pass back a pointer to the lock protecting
* the object, but without locking it.
* Register an object pointer in reference table and lock the object.
* Returns a unique reference value that is used from then on to retrieve the
* object pointer, or to determine that the object has been deregistered.
*
* Note: The object is returned in the locked state so that the caller can
* register a partially initialized object, without running the risk that
* the object will be accessed before initialization is complete.
*/
u32 tipc_ref_acquire(void *object, spinlock_t **lock)
@@ -178,13 +182,13 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
ref = (next_plus_upper & ~index_mask) + index;
entry->ref = ref;
entry->object = object;
spin_unlock_bh(&entry->lock);
*lock = &entry->lock;
}
else if (tipc_ref_table.init_point < tipc_ref_table.capacity) {
index = tipc_ref_table.init_point++;
entry = &(tipc_ref_table.entries[index]);
spin_lock_init(&entry->lock);
spin_lock_bh(&entry->lock);
ref = tipc_ref_table.start_mask + index;
entry->ref = ref;
entry->object = object;