Re: race in net/ipv4/ipip.c ?

[Lennert Buytenhek <buytenh@xxxxxxxxxxxxxx>]

On Wed, Jan 12, 2005 at 01:53:36PM +0100, Thomas Graf wrote:

> >     static void ipip_tunnel_link(struct ipip_tunnel *t)
> >     {
> >             struct ipip_tunnel **tp = ipip_bucket(t);
> > 
> >             t->next = *tp;
> >             write_lock_bh(&ipip_lock);
> >             *tp = t;
> >             write_unlock_bh(&ipip_lock);
> >     }
> > 
> > Shouldn't the "t->next = *tp" be done inside the write lock?
> 
> Why do you think so? linking may only happen on new tunnels
> so they can't be found before they're assigned to the bucket.
> dev_hold is called correctly so dev->priv usage is safe as
> well.

What if you add two tunnels at the same time?  (Or is that perhaps
synchronised on a higher level?)


--L