Commit ab0a9fd1 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

[IPV6]: Close small race in ip6_del_rt

There is a small SMP race in ip6_del_rt where we maybe dereferencing a dst
that has been freed.  This patch fixes it.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent db5e93fe
...@@ -979,9 +979,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr) ...@@ -979,9 +979,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
rt6_reset_dflt_pointer(NULL); rt6_reset_dflt_pointer(NULL);
err = fib6_del(rt, nlh, _rtattr);
dst_release(&rt->u.dst); dst_release(&rt->u.dst);
err = fib6_del(rt, nlh, _rtattr);
write_unlock_bh(&rt6_lock); write_unlock_bh(&rt6_lock);
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment