Wed, May 20, 2015 at 07:48:21AM CEST, simon.hor...@netronome.com wrote:
>rocker_port_ipv4_nh() and in turn rocker_port_ipv4_neigh() may be
>be called with trans == SWITCHDEV_TRANS_PREPARE and then
>trans == SWITCHDEV_TRANS_COMMIT from switchdev_port_obj_set() via
>fib_table_insert().
>
>The first time that rocker_port_ipv4_nh() is called, with
>trans == SWITCHDEV_TRANS_PREPARE, _rocker_neigh_add() adds a new entry to
>the neigh table.
>
>And the second time rocker_port_ipv4_nh() is called, with
>trans == SWITCHDEV_TRANS_COMMIT, that entry is found. This causes
>rocker_port_ipv4_nh() to believe it is not adding an entry and thus it
>frees "entry", which is still present in rocker driver's neigh table.
>
>This problem does not appear to affect deletion as my analysis is that
>deletion is always performed with trans == SWITCHDEV_TRANS_NONE.
>
>For completeness _rocker_neigh_{add,del,prepare} are updated not to
>manipulate fib table entries if trans == SWITCHDEV_TRANS_PREPARE.
>
>Fixes: c4f20321d968 ("rocker: support prepare-commit transaction model")
>Reported-by: oshiaki Makita <makita.toshi...@lab.ntt.co.jp>
>Acked-by: Scott Feldman <sfel...@gmail.com>
>Signed-off-by: Simon Horman <simon.hor...@netronome.com>
Acked-by: Jiri Pirko <j...@resnulli.us>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
