Re: [PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

[Tung Quang Nguyen]

> Subject: [PATCH net] tipc: Fix a data race on mon->peer_cnt in mon_timeout()

> mon_timeout() evaluates dom_size(mon->peer_cnt) before it takes mon->lock,
> while mon->peer_cnt is updated under that lock by tipc_mon_add_peer() and
> tipc_mon_remove_peer().  The value can therefore be stale, and the decision
> whether the local domain has to be recomputed can be based on an outdated
> member count.

> Read mon->peer_cnt inside the write_lock_bh(&mon->lock) protected region.

> Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")
> Signed-off-by: Ginger Li <ginger.jzllee@xxxxxxxxx>

Reviewed-by: Tung Nguyen <tung.quang.nguyen@xxxxxxxx>