rhashtable: Fix unprotected RCU dereference in __rht_ptr

[linux-2.6-microblaze.git] / include / linux / rhashtable.h

diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index d3432ee..b8feb5d 100644 (file)
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -349,11 +349,11 @@ static inline void rht_unlock(struct bucket_table *tbl,
        local_bh_enable();
 }
 
-static inline struct rhash_head __rcu *__rht_ptr(
-       struct rhash_lock_head *const *bkt)
+static inline struct rhash_head *__rht_ptr(
+       struct rhash_lock_head *p, struct rhash_lock_head __rcu *const *bkt)
 {
-       return (struct rhash_head __rcu *)
-               ((unsigned long)*bkt & ~BIT(0) ?:
+       return (struct rhash_head *)
+               ((unsigned long)p & ~BIT(0) ?:
                 (unsigned long)RHT_NULLS_MARKER(bkt));
 }
 
@@ -365,25 +365,26 @@ static inline struct rhash_head __rcu *__rht_ptr(
  *            access is guaranteed, such as when destroying the table.
  */
 static inline struct rhash_head *rht_ptr_rcu(
-       struct rhash_lock_head *const *bkt)
+       struct rhash_lock_head *const *p)
 {
-       struct rhash_head __rcu *p = __rht_ptr(bkt);
-
-       return rcu_dereference(p);
+       struct rhash_lock_head __rcu *const *bkt = (void *)p;
+       return __rht_ptr(rcu_dereference(*bkt), bkt);
 }
 
 static inline struct rhash_head *rht_ptr(
-       struct rhash_lock_head *const *bkt,
+       struct rhash_lock_head *const *p,
        struct bucket_table *tbl,
        unsigned int hash)
 {
-       return rht_dereference_bucket(__rht_ptr(bkt), tbl, hash);
+       struct rhash_lock_head __rcu *const *bkt = (void *)p;
+       return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
 }
 
 static inline struct rhash_head *rht_ptr_exclusive(
-       struct rhash_lock_head *const *bkt)
+       struct rhash_lock_head *const *p)
 {
-       return rcu_dereference_protected(__rht_ptr(bkt), 1);
+       struct rhash_lock_head __rcu *const *bkt = (void *)p;
+       return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
 }
 
 static inline void rht_assign_locked(struct rhash_lock_head **bkt,