datapath: Use call_rcu() when deleting a datapath.
authorJesse Gross <jesse@nicira.com>
Wed, 5 Jan 2011 20:39:57 +0000 (12:39 -0800)
committerJesse Gross <jesse@nicira.com>
Wed, 5 Jan 2011 22:05:03 +0000 (14:05 -0800)
commit46c6a11da0409a4f52fd6ea5f72154c73af0ba47
tree871ad6e5687aea5f73ac6c1fd1bfa3d5bb051afd
parentbbe8d06ea2300ea907ab7efcaa66785a59095402
datapath: Use call_rcu() when deleting a datapath.

When deleting a datapath, we remove all of the vports and then immediately
free the datapath data structures.  Since the vports are allowed to use
call_rcu() to free their data, it's possible for them to return immediately
while packet processing is still taking place.  This breaks apart the dropping
of references and the freeing of the data using call_rcu() for protection.

This race cannot actually occur in practice since the last port to be
deleted is an internal device, which uses synchronize_rcu() itself
(implicitly through unregister_netdevice()).  However, there is no
requirement that it must do this nor should there be.

Reported-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
datapath/datapath.c
datapath/datapath.h