summaryrefslogtreecommitdiffstats
path: root/net/rds/af_rds.c
diff options
context:
space:
mode:
authorZach Brown <zach.brown@oracle.com>2010-07-23 10:32:31 -0700
committerAndy Grover <andy.grover@oracle.com>2010-09-08 18:16:47 -0700
commit5adb5bc65f93e52341c3fc9d03d4030dd375e256 (patch)
tree55b19c7757ccd64f58169a05cd63e91bee409bad /net/rds/af_rds.c
parent77510481c0c3980c8979ed236d63e59221fb8ce5 (diff)
downloadlinux-5adb5bc65f93e52341c3fc9d03d4030dd375e256.tar.gz
linux-5adb5bc65f93e52341c3fc9d03d4030dd375e256.tar.bz2
linux-5adb5bc65f93e52341c3fc9d03d4030dd375e256.zip
RDS: have sockets get transport module references
Right now there's nothing to stop the various paths that use rs->rs_transport from racing with rmmod and executing freed transport code. The simple fix is to have binding to a transport also hold a reference to the transport's module, removing this class of races. We already had an unused t_owner field which was set for the modular transports and which wasn't set for the built-in loop transport. Signed-off-by: Zach Brown <zach.brown@oracle.com>
Diffstat (limited to 'net/rds/af_rds.c')
-rw-r--r--net/rds/af_rds.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 57ef0ec4f03d..8e3886d353b5 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -90,6 +90,8 @@ static int rds_release(struct socket *sock)
rds_sock_count--;
spin_unlock_irqrestore(&rds_sock_lock, flags);
+ rds_trans_put(rs->rs_transport);
+
sock->sk = NULL;
sock_put(sk);
out: