RDS: have sockets get transport module references
Right now there's nothing to stop the various paths that use rs->rs_transport from racing with rmmod and executing freed transport code. The simple fix is to have binding to a transport also hold a reference to the transport's module, removing this class of races. We already had an unused t_owner field which was set for the modular transports and which wasn't set for the built-in loop transport. Signed-off-by: Zach Brown <zach.brown@oracle.com>
This commit is contained in:
@@ -90,6 +90,8 @@ static int rds_release(struct socket *sock)
|
||||
rds_sock_count--;
|
||||
spin_unlock_irqrestore(&rds_sock_lock, flags);
|
||||
|
||||
rds_trans_put(rs->rs_transport);
|
||||
|
||||
sock->sk = NULL;
|
||||
sock_put(sk);
|
||||
out:
|
||||
|
||||
Reference in New Issue
Block a user