aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Dumazet <dada1@cosmosbay.com>2008-12-09 16:14:11 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2008-12-10 11:01:52 -0500
commitfd3d664fef97cf01f8e28fe0b024ad52f3bbc1bc (patch)
treecc1b4d38e5ebd88c25b2bcee684c9e882be9a2ac
parentfe102c71a65a503646bcc94ccb6859da613c2f4f (diff)
percpu_counter: fix CPU unplug race in percpu_counter_destroy()
We should first delete the counter from percpu_counters list before freeing memory, or a percpu_counter_hotcpu_callback() could dereference a NULL pointer. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: David S. Miller <davem@davemloft.net> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Mingming Cao <cmm@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--lib/percpu_counter.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index a8663890a88c..71b265c330ce 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -104,13 +104,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc)
104 if (!fbc->counters) 104 if (!fbc->counters)
105 return; 105 return;
106 106
107 free_percpu(fbc->counters);
108 fbc->counters = NULL;
109#ifdef CONFIG_HOTPLUG_CPU 107#ifdef CONFIG_HOTPLUG_CPU
110 mutex_lock(&percpu_counters_lock); 108 mutex_lock(&percpu_counters_lock);
111 list_del(&fbc->list); 109 list_del(&fbc->list);
112 mutex_unlock(&percpu_counters_lock); 110 mutex_unlock(&percpu_counters_lock);
113#endif 111#endif
112 free_percpu(fbc->counters);
113 fbc->counters = NULL;
114} 114}
115EXPORT_SYMBOL(percpu_counter_destroy); 115EXPORT_SYMBOL(percpu_counter_destroy);
116 116