bridge: Fix RCU race in br_multicast_stop
Herbert Xu [Fri, 5 Mar 2010 21:03:35 +0000 (21:03 +0000)]
Thanks to Paul McKenny for pointing out that it is incorrect to use
synchronize_rcu_bh to ensure that pending callbacks have completed.
Instead we should use rcu_barrier_bh.

Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/bridge/br_multicast.c

index a1ffe15..12ce1ea 100644 (file)
@@ -1135,7 +1135,7 @@ void br_multicast_stop(struct net_bridge *br)
 
        if (mdb->old) {
                spin_unlock_bh(&br->multicast_lock);
-               synchronize_rcu_bh();
+               rcu_barrier_bh();
                spin_lock_bh(&br->multicast_lock);
                WARN_ON(mdb->old);
        }