Re: race in net/ipv4/ipip.c ?

[YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@xxxxxxxxxxxxxx>]

In article <20050112125336.GH26856@xxxxxxxxxxxxxx> (at Wed, 12 Jan 2005 
13:53:36 +0100), Thomas Graf <tgraf@xxxxxxx> says:

> * Lennert Buytenhek <20050112122300.GA12155@xxxxxxxxxxxxxxxxx> 2005-01-12 
> 13:23
:
> >     static void ipip_tunnel_link(struct ipip_tunnel *t)
> >     {
> >             struct ipip_tunnel **tp = ipip_bucket(t);
> > 
> >             t->next = *tp;
> >             write_lock_bh(&ipip_lock);
> >             *tp = t;
> >             write_unlock_bh(&ipip_lock);
> >     }
> > 
> > Shouldn't the "t->next = *tp" be done inside the write lock?
> 
> Why do you think so? linking may only happen on new tunnels
> so they can't be found before they're assigned to the bucket.
> dev_hold is called correctly so dev->priv usage is safe as
> well.

How about adding multiple tunnels (with same ipip_bucket(t))
concurrently? :-)

--yoshfuji