diff options
| author | Jay Vosburgh <fubar@us.ibm.com> | 2006-01-09 23:14:00 +0300 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@pobox.com> | 2006-01-13 00:35:39 +0300 |
| commit | 5af47b2ff124fdad9ba84baeb9f7eeebeb227b43 (patch) | |
| tree | 1085c636295cd3f9ade5611f9519d83731e27cdc /drivers/net/bonding/bond_alb.c | |
| parent | 9a6301c114aaab1df6de6fad9899bb89852a7592 (diff) | |
| download | linux-5af47b2ff124fdad9ba84baeb9f7eeebeb227b43.tar.xz | |
[PATCH] bonding: UPDATED hash-table corruption in bond_alb.c
I believe I see the race Michael refers to (tlb_choose_channel
may set head, which tlb_init_slave clears), although I was not able to
reproduce it. I have updated his patch for the current netdev-2.6.git
tree and added a version update. His original comment follows:
Our systems have been crashing during testing of PCI HotPlug
support in the various networking components. We've faulted in
the bonding driver due to a bug in bond_alb.c:tlb_clear_slave()
In that routine, the last modification to the TLB hash table is
made without protection of the lock, allowing a race that can lead
tlb_choose_channel() to select an invalid table element.
-J
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Diffstat (limited to 'drivers/net/bonding/bond_alb.c')
| -rw-r--r-- | drivers/net/bonding/bond_alb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 854ddfb90da1..f2a63186ae05 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -169,9 +169,9 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_ index = next_index; } - _unlock_tx_hashtbl(bond); - tlb_init_slave(slave); + + _unlock_tx_hashtbl(bond); } /* Must be called before starting the monitor timer */ |