Subject: dn_route.c momentarily exiting RCU read-side critical section

From: "Paul E. McKenney" <[email-masked]>
Date: Mon, 29 Oct 2007 14:15:40 -0700

Hello!

net/decnet/dn_route.c in dn_rt_cache_get_next() is as follows:

static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
{
	struct dn_rt_cache_iter_state *s = rcu_dereference(seq->private);

	rt = rt->u.dst.dn_next;
	while(!rt) {
		rcu_read_unlock_bh();
		if (--s->bucket < 0)
			break;

...  But what happens if seq->private is freed up right here?
...  Or what prevents this from happening?

		rcu_read_lock_bh();
		rt = dn_rt_hash_table[s->bucket].chain;
	}
	return rt;
}

Similar code is in rt_cache_get_next().

So, what am I missing here?

						Thanx, Paul