[3.13.y.z extended stable] Patch "team: avoid race condition in scheduling delayed work" has been added to staging queue

Kamal Mostafa kamal at canonical.com
Fri Oct 31 20:53:24 UTC 2014

This is a note to let you know that I have just added a patch titled

    team: avoid race condition in scheduling delayed work

to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree 
which can be found at:


This patch is scheduled to be released in version

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y.z tree, see



>From 08e2bf25aa4f593583ef7182c6bddf8e14c04582 Mon Sep 17 00:00:00 2001
From: Joe Lawrence <Joe.Lawrence at stratus.com>
Date: Fri, 3 Oct 2014 09:58:34 -0400
Subject: team: avoid race condition in scheduling delayed work

[ Upstream commit 47549650abd13d873fd2e5fc218db19e21031074 ]

When team_notify_peers and team_mcast_rejoin are called, they both reset
their respective .count_pending atomic variable. Then when the actual
worker function is executed, the variable is atomically decremented.
This pattern introduces a potential race condition where the
.count_pending rolls over and the worker function keeps rescheduling
until .count_pending decrements to zero again:

THREAD 1                           THREAD 2

========                           ========
  atomic_set count_pending = 1
                                   atomic_set count_pending = 1
    count_pending = 0
                                     count_pending = -1
                                   (repeat until count_pending = 0)

Instead of assigning a new value to .count_pending, use atomic_add to
tack-on the additional desired worker function invocations.

Signed-off-by: Joe Lawrence <joe.lawrence at stratus.com>
Acked-by: Jiri Pirko <jiri at resnulli.us>
Fixes: fc423ff00df3a19554414ee ("team: add peer notification")
Fixes: 492b200efdd20b8fcfdac87 ("team: add support for sending multicast rejoins")
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
 drivers/net/team/team.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 99500d1..2898c2a 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -647,7 +647,7 @@ static void team_notify_peers(struct team *team)
 	if (!team->notify_peers.count || !netif_running(team->dev))
-	atomic_set(&team->notify_peers.count_pending, team->notify_peers.count);
+	atomic_add(team->notify_peers.count, &team->notify_peers.count_pending);
 	schedule_delayed_work(&team->notify_peers.dw, 0);

@@ -687,7 +687,7 @@ static void team_mcast_rejoin(struct team *team)
 	if (!team->mcast_rejoin.count || !netif_running(team->dev))
-	atomic_set(&team->mcast_rejoin.count_pending, team->mcast_rejoin.count);
+	atomic_add(team->mcast_rejoin.count, &team->mcast_rejoin.count_pending);
 	schedule_delayed_work(&team->mcast_rejoin.dw, 0);


More information about the kernel-team mailing list