From fe8ff6b58f040dd52d2db45972db8e0301847f1c Mon Sep 17 00:00:00 2001 From: Zach Brown Date: Fri, 23 Jul 2010 10:30:45 -0700 Subject: RDS: lock rds_conn_count decrement in rds_conn_destroy() rds_conn_destroy() can race with all other modifications of the rds_conn_count but it was modifying the count without locking. Signed-off-by: Zach Brown --- net/rds/connection.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'net/rds/connection.c') diff --git a/net/rds/connection.c b/net/rds/connection.c index 0de40d9563ca..75a1a37d64d3 100644 --- a/net/rds/connection.c +++ b/net/rds/connection.c @@ -313,6 +313,7 @@ void rds_conn_shutdown(struct rds_connection *conn) void rds_conn_destroy(struct rds_connection *conn) { struct rds_message *rm, *rtmp; + unsigned long flags; rdsdebug("freeing conn %p for %pI4 -> " "%pI4\n", conn, &conn->c_laddr, @@ -350,7 +351,9 @@ void rds_conn_destroy(struct rds_connection *conn) BUG_ON(!list_empty(&conn->c_retrans)); kmem_cache_free(rds_conn_slab, conn); + spin_lock_irqsave(&rds_conn_lock, flags); rds_conn_count--; + spin_unlock_irqrestore(&rds_conn_lock, flags); } EXPORT_SYMBOL_GPL(rds_conn_destroy); -- cgit v1.2.3-58-ga151