summaryrefslogtreecommitdiff
path: root/net/packet
diff options
context:
space:
mode:
authorWillem de Bruijn <willemb@google.com>2015-06-16 12:51:37 -0400
committerDavid S. Miller <davem@davemloft.net>2015-06-21 09:30:42 -0700
commit59f211181b5b10d4a95e1b9226febb0c0b6497c6 (patch)
tree2f9ee4c3d1c9687d50b179fe63650ce55ac8daf4 /net/packet
parent120119623b6798b70384248c0cacf8f8de419c9a (diff)
packet: free packet_rollover after synchronize_net
Destruction of the po->rollover must be delayed until there are no more packets in flight that can access it. The field is destroyed in packet_release, before synchronize_net. Delay using rcu. Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/packet')
-rw-r--r--net/packet/af_packet.c3
-rw-r--r--net/packet/internal.h1
2 files changed, 3 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fd5164139bf0..20e8c40da90d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1634,7 +1634,8 @@ static void fanout_release(struct sock *sk)
}
mutex_unlock(&fanout_mutex);
- kfree(po->rollover);
+ if (po->rollover)
+ kfree_rcu(po->rollover, rcu);
}
static const struct proto_ops packet_ops;
diff --git a/net/packet/internal.h b/net/packet/internal.h
index c035d263c1e8..e20b3e8829b8 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -89,6 +89,7 @@ struct packet_fanout {
struct packet_rollover {
int sock;
+ struct rcu_head rcu;
atomic_long_t num;
atomic_long_t num_huge;
atomic_long_t num_failed;