Commit 83f6a740 authored by stephen hemminger's avatar stephen hemminger Committed by David S. Miller
Browse files

bridge: multicast port group RCU fix



The recently introduced bridge mulitcast port group list was only
partially using RCU correctly. It was missing rcu_dereference()
and missing the necessary barrier on deletion.

The code should have used one of the standard list methods (list or hlist)
instead of open coding a RCU based link list.
Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 168d40ee
...@@ -217,7 +217,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, ...@@ -217,7 +217,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
prev = NULL; prev = NULL;
rp = rcu_dereference(br->router_list.first); rp = rcu_dereference(br->router_list.first);
p = mdst ? mdst->ports : NULL; p = mdst ? rcu_dereference(mdst->ports) : NULL;
while (p || rp) { while (p || rp) {
lport = p ? p->port : NULL; lport = p ? p->port : NULL;
rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) : rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
...@@ -231,7 +231,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst, ...@@ -231,7 +231,7 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
goto out; goto out;
if ((unsigned long)lport >= (unsigned long)port) if ((unsigned long)lport >= (unsigned long)port)
p = p->next; p = rcu_dereference(p->next);
if ((unsigned long)rport >= (unsigned long)port) if ((unsigned long)rport >= (unsigned long)port)
rp = rcu_dereference(rp->next); rp = rcu_dereference(rp->next);
} }
......
...@@ -259,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br, ...@@ -259,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
if (p != pg) if (p != pg)
continue; continue;
*pp = p->next; rcu_assign_pointer(*pp, p->next);
hlist_del_init(&p->mglist); hlist_del_init(&p->mglist);
del_timer(&p->timer); del_timer(&p->timer);
del_timer(&p->query_timer); del_timer(&p->query_timer);
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment