summaryrefslogtreecommitdiffstats
path: root/net/atm
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2012-02-21 10:46:49 +0000
committerDavid S. Miller <davem@davemloft.net>2012-02-22 02:23:25 -0500
commit597cdbc2239e6019bbb2dd73b266f436166f0427 (patch)
treeb6c25dddc2987c9e7811d826f991dd6407783b7f /net/atm
parenta5e7424d424f6398a198ead79d99e0a3c2f24ce8 (diff)
downloadlinux-stable-597cdbc2239e6019bbb2dd73b266f436166f0427.tar.gz
linux-stable-597cdbc2239e6019bbb2dd73b266f436166f0427.tar.bz2
linux-stable-597cdbc2239e6019bbb2dd73b266f436166f0427.zip
atm: clip: remove clip_tbl
Commit 32092ecf0644 (atm: clip: Use device neigh support on top of "arp_tbl".) introduced a bug since clip_tbl is zeroed : Crash occurs in __neigh_for_each_release() idle_timer_check() must use instead arp_tbl and neigh_check_cb() should ignore non clip neighbours. Idea from David Miller. Reported-by: Meelis Roos <mroos@linux.ee> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Meelis Roos <mroos@linux.ee> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm')
-rw-r--r--net/atm/clip.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/net/atm/clip.c b/net/atm/clip.c
index c12c2582457c..127fe70a1baa 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -46,8 +46,8 @@
static struct net_device *clip_devs;
static struct atm_vcc *atmarpd;
-static struct neigh_table clip_tbl;
static struct timer_list idle_timer;
+static const struct neigh_ops clip_neigh_ops;
static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
{
@@ -123,6 +123,8 @@ static int neigh_check_cb(struct neighbour *n)
struct atmarp_entry *entry = neighbour_priv(n);
struct clip_vcc *cv;
+ if (n->ops != &clip_neigh_ops)
+ return 0;
for (cv = entry->vccs; cv; cv = cv->next) {
unsigned long exp = cv->last_use + cv->idle_timeout;
@@ -154,10 +156,10 @@ static int neigh_check_cb(struct neighbour *n)
static void idle_timer_check(unsigned long dummy)
{
- write_lock(&clip_tbl.lock);
- __neigh_for_each_release(&clip_tbl, neigh_check_cb);
+ write_lock(&arp_tbl.lock);
+ __neigh_for_each_release(&arp_tbl, neigh_check_cb);
mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
- write_unlock(&clip_tbl.lock);
+ write_unlock(&arp_tbl.lock);
}
static int clip_arp_rcv(struct sk_buff *skb)