-
Bug
-
Resolution: Fixed
-
Medium
-
None
-
None
-
3
-
9223372036854775807
InĀ nrs_tbf_cli_findadd(), when found a class bucket form rhashtable but with refcount of 0, it should continue to check whether it is in LRU. But the implementation uses the wrong class bucket for the check.
static struct nrs_tbf_client * nrs_tbf_cli_findadd(struct nrs_tbf_head *head, struct nrs_tbf_client *cli) { struct nrs_tbf_client *cli2 = NULL; try_again: rcu_read_lock(); cli2 = rhashtable_lookup_get_insert_fast(&head->th_cli_rhash, &cli->tc_rhash, head->th_rhash_params); if (IS_ERR(cli2)) goto out; if (cli2 && !refcount_inc_not_zero(&cli2->tc_ref)) { cli2 = nrs_tbf_lru_tryhit(head, cli); ==> "cli" -> "cli2" if (!cli2) { /* lost race -> retry */ rcu_read_unlock(); schedule(); goto try_again; } }