Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in
  • L linux-vm
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
    • Locked files
  • Issues 0
    • Issues 0
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • linux-arm
  • linux-vm
  • Repository
  • linux-vm
  • net
  • tipc
  • discover.c
Find file BlameHistoryPermalink
  • Ying Xue's avatar
    tipc: fix race in disc create/delete · a8b9b96e
    Ying Xue authored Apr 21, 2014
    Commit a21a584d
    
     (tipc: fix neighbor
    detection problem after hw address change) introduces a race condition
    involving tipc_disc_delete() and tipc_disc_add/remove_dest that can
    cause TIPC to dereference the pointer to the bearer discovery request
    structure after it has been freed since a stray pointer is left in the
    bearer structure.
    
    In order to fix the issue, the process of resetting the discovery
    request handler is optimized: the discovery request handler and request
    buffer are just reset instead of being freed, allocated and initialized.
    As the request point is always valid and the request's lock is taken
    while the request handler is reset, the race doesn't happen any more.
    
    Reported-by: default avatarErik Hugne <erik.hugne@ericsson.com>
    Signed-off-by: Ying Xue's avatarYing Xue <ying.xue@windriver.com>
    Reviewed-by: default avatarErik Hugne <erik.hugne@ericsson.com>
    Tested-by: default avatarErik Hugne <erik.hugne@ericsson.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a8b9b96e