Commit 10e4ea75 authored by Tom Herbert's avatar Tom Herbert Committed by David S. Miller
Browse files

net: Fix race condition in store_rps_map

There is a race condition in store_rps_map that allows jump label
count in rps_needed to go below zero. This can happen when
concurrently attempting to set and a clear map.


1. rps_needed count is zero
2. New map is assigned by setting thread, but rps_needed count _not_ yet
   incremented (rps_needed count still zero)
2. Map is cleared by second thread, old_map set to that just assigned
3. Second thread performs static_key_slow_dec, rps_needed count now goes

Fix is to increment or decrement rps_needed under the spinlock.

Signed-off-by: default avatarTom Herbert <>
Signed-off-by: default avatarDavid S. Miller <>
parent e05176a3
......@@ -726,14 +726,17 @@ static ssize_t store_rps_map(struct netdev_rx_queue *queue,
old_map = rcu_dereference_protected(queue->rps_map,
rcu_assign_pointer(queue->rps_map, map);
if (map)
if (old_map) {
kfree_rcu(old_map, rcu);
if (old_map)
if (old_map)
kfree_rcu(old_map, rcu);
return len;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment