diff options
author | Herbert Xu <herbert@gondor.apana.org.au> | 2015-02-03 15:33:22 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2015-02-04 23:34:52 -0500 |
commit | 28134a53d624ae7e90fff8500b25b3add4d40b92 (patch) | |
tree | f919a71660f25f7d50c927df06df0d265cff2524 /lib/rhashtable.c | |
parent | 9b55669c14212f89dba39a2d8e00c1ec1d44c1ec (diff) |
rhashtable: Fix potential crash on destroy in rhashtable_shrink
The current being_destroyed check in rhashtable_expand is not
enough since if we start a shrinking process after freeing all
elements in the table that's also going to crash.
This patch adds a being_destroyed check to the deferred worker
thread so that we bail out as soon as we take the lock.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/rhashtable.c')
-rw-r--r-- | lib/rhashtable.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/rhashtable.c b/lib/rhashtable.c index c41e21096373..904b419b72f5 100644 --- a/lib/rhashtable.c +++ b/lib/rhashtable.c | |||
@@ -487,6 +487,9 @@ static void rht_deferred_worker(struct work_struct *work) | |||
487 | 487 | ||
488 | ht = container_of(work, struct rhashtable, run_work); | 488 | ht = container_of(work, struct rhashtable, run_work); |
489 | mutex_lock(&ht->mutex); | 489 | mutex_lock(&ht->mutex); |
490 | if (ht->being_destroyed) | ||
491 | goto unlock; | ||
492 | |||
490 | tbl = rht_dereference(ht->tbl, ht); | 493 | tbl = rht_dereference(ht->tbl, ht); |
491 | 494 | ||
492 | if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size)) | 495 | if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size)) |
@@ -494,6 +497,7 @@ static void rht_deferred_worker(struct work_struct *work) | |||
494 | else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size)) | 497 | else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size)) |
495 | rhashtable_shrink(ht); | 498 | rhashtable_shrink(ht); |
496 | 499 | ||
500 | unlock: | ||
497 | mutex_unlock(&ht->mutex); | 501 | mutex_unlock(&ht->mutex); |
498 | } | 502 | } |
499 | 503 | ||