diff options
| author | Eric Dumazet <dada1@cosmosbay.com> | 2008-12-09 22:14:11 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-12-10 17:01:52 +0100 |
| commit | fd3d664fef97cf01f8e28fe0b024ad52f3bbc1bc (patch) | |
| tree | cc1b4d38e5ebd88c25b2bcee684c9e882be9a2ac /lib | |
| parent | rtc: fix missing id_table in rtc-ds1672 and rtc-max6900 drivers (diff) | |
| download | linux-fd3d664fef97cf01f8e28fe0b024ad52f3bbc1bc.tar.xz linux-fd3d664fef97cf01f8e28fe0b024ad52f3bbc1bc.zip | |
percpu_counter: fix CPU unplug race in percpu_counter_destroy()
We should first delete the counter from percpu_counters list
before freeing memory, or a percpu_counter_hotcpu_callback()
could dereference a NULL pointer.
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Acked-by: David S. Miller <davem@davemloft.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mingming Cao <cmm@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/percpu_counter.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c index a8663890a88c..71b265c330ce 100644 --- a/lib/percpu_counter.c +++ b/lib/percpu_counter.c @@ -104,13 +104,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc) if (!fbc->counters) return; - free_percpu(fbc->counters); - fbc->counters = NULL; #ifdef CONFIG_HOTPLUG_CPU mutex_lock(&percpu_counters_lock); list_del(&fbc->list); mutex_unlock(&percpu_counters_lock); #endif + free_percpu(fbc->counters); + fbc->counters = NULL; } EXPORT_SYMBOL(percpu_counter_destroy); |