Am 2. März 2018 12:37:25 MEZ schrieb Kirill Tkhai :
>destroy_radio() may be executed in parallel with everything above you
>wrote,
>doesn't it? There may be several network namespaces, and
>destroy_radio()
>queued from one net namespace may race with mac80211_hwsim_new_radio()
>or hwsim_del_radio
On 01.03.2018 20:22, Benjamin Beichler wrote:
> Am 01.03.2018 um 12:30 schrieb Kirill Tkhai:
>
>> Out of bounds of this patch, just as a report to wireless subsystem
>> maintainer, destroy_radio() increaments hwsim_radios_generation
>> without hwsim_radio_lock, so this may need one more patch to f
Am 01.03.2018 um 12:30 schrieb Kirill Tkhai:
> Out of bounds of this patch, just as a report to wireless subsystem
> maintainer, destroy_radio() increaments hwsim_radios_generation
> without hwsim_radio_lock, so this may need one more patch to fix.
>
The lock is here implicit, because the value on
hwsim_netgroup counter is declarated as int, and it is incremented
every time a new net is created. After sizeof(int) net are created,
it will overflow, and different net namespaces will have the same
identifier. This patch fixes the problem by introducing IDA instead
of int counter. IDA guarantees