pkt_sched: Change misleading code in class delete.
authorJarek Poplawski <jarkao2@gmail.com>
Mon, 16 Mar 2009 03:00:19 +0000 (20:00 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 16 Mar 2009 03:00:19 +0000 (20:00 -0700)
commit7cd0a63872ac6ef97265f07adc367ca4f984468e
tree44265aa422b3133b07eee87280cca3c89225437a
parent8bdd663aba341c15cd2fa9dbd7061b8b387964dc
pkt_sched: Change misleading code in class delete.

While looking for a possible reason of bugzilla report on HTB oops:
http://bugzilla.kernel.org/show_bug.cgi?id=12858
I found the code in htb_delete calling htb_destroy_class on zero
refcount is very misleading: it can suggest this is a common path, and
destroy is called under sch_tree_lock. Actually, this can never happen
like this because before deletion cops->get() is done, and after
delete a class is still used by tclass_notify. The class destroy is
always called from cops->put(), so without sch_tree_lock.

This doesn't mean much now (since 2.6.27) because all vulnerable calls
were moved from htb_destroy_class to htb_delete, but there was a bug
in older kernels. The same change is done for other classful scheds,
which, it seems, didn't have similar locking problems here.

Reported-by: m0sia <m0sia@m0sia.ru>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/sch_cbq.c
net/sched/sch_drr.c
net/sched/sch_hfsc.c
net/sched/sch_htb.c