diff options
| author | Veaceslav Falico <[email protected]> | 2013-11-29 09:53:23 +0100 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2013-11-29 16:11:08 -0500 |
| commit | ec6f809ff6f19fafba3212f6aff0dda71dfac8e8 (patch) | |
| tree | 6218fc1ecc6805427b753c4f2573f910c6793e1d | |
| parent | 006da7b07bc4d3a7ffabad17cf639eec6849c9dc (diff) | |
af_packet: block BH in prb_shutdown_retire_blk_timer()
Currently we're using plain spin_lock() in prb_shutdown_retire_blk_timer(),
however the timer might fire right in the middle and thus try to re-aquire
the same spinlock, leaving us in a endless loop.
To fix that, use the spin_lock_bh() to block it.
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
CC: "David S. Miller" <[email protected]>
CC: Daniel Borkmann <[email protected]>
CC: Willem de Bruijn <[email protected]>
CC: Phil Sutter <[email protected]>
CC: Eric Dumazet <[email protected]>
Reported-by: Jan Stancek <[email protected]>
Tested-by: Jan Stancek <[email protected]>
Signed-off-by: Veaceslav Falico <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
| -rw-r--r-- | net/packet/af_packet.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ac27c86ef6d1..ba2548bd85bf 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -439,9 +439,9 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po, pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc; - spin_lock(&rb_queue->lock); + spin_lock_bh(&rb_queue->lock); pkc->delete_blk_timer = 1; - spin_unlock(&rb_queue->lock); + spin_unlock_bh(&rb_queue->lock); prb_del_retire_blk_timer(pkc); } |