From 5af47b2ff124fdad9ba84baeb9f7eeebeb227b43 Mon Sep 17 00:00:00 2001 From: Jay Vosburgh Date: Mon, 9 Jan 2006 12:14:00 -0800 Subject: [PATCH] bonding: UPDATED hash-table corruption in bond_alb.c I believe I see the race Michael refers to (tlb_choose_channel may set head, which tlb_init_slave clears), although I was not able to reproduce it. I have updated his patch for the current netdev-2.6.git tree and added a version update. His original comment follows: Our systems have been crashing during testing of PCI HotPlug support in the various networking components. We've faulted in the bonding driver due to a bug in bond_alb.c:tlb_clear_slave() In that routine, the last modification to the TLB hash table is made without protection of the lock, allowing a race that can lead tlb_choose_channel() to select an invalid table element. -J Signed-off-by: Jeff Garzik --- drivers/net/bonding/bond_alb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/net/bonding/bond_alb.c') diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 854ddfb90da..f2a63186ae0 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -169,9 +169,9 @@ static void tlb_clear_slave(struct bonding *bond, struct slave *slave, int save_ index = next_index; } - _unlock_tx_hashtbl(bond); - tlb_init_slave(slave); + + _unlock_tx_hashtbl(bond); } /* Must be called before starting the monitor timer */ -- cgit v1.2.3