Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[AF_IUCV]: broken send_skb_q results in endless loop

Browse source 
A race has been detected in iucv_callback_txdone().
skb_unlink has to be done inside the locked area.

In addition checkings for successful allocations are inserted.

Signed-off-by: Ursula Braun <braunu@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ursula Braun 2008-02-07 18:07:19 -08:00 • committed by David S. Miller
parent 435bc9dfc6
commit d44447229e
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
net/iucv/af_iucv.c
View file

@ -482,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
/* Create path. */ /* Create path. */
iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT, iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
IPRMDATA, GFP_KERNEL); IPRMDATA, GFP_KERNEL);
if (!iucv->path) {
err = -ENOMEM;
goto done;
}
err = iucv_path_connect(iucv->path, &af_iucv_handler, err = iucv_path_connect(iucv->path, &af_iucv_handler,
sa->siucv_user_id, NULL, user_data, sk); sa->siucv_user_id, NULL, user_data, sk);
if (err) { if (err) {
@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
save_message: save_message:
save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA); save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
if (!save_msg)
return;
save_msg->path = path; save_msg->path = path;
save_msg->msg = *msg; save_msg->msg = *msg;
@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path,
this = list_skb; this = list_skb;
list_skb = list_skb->next; list_skb = list_skb->next;
} while (memcmp(&msg->tag, this->cb, 4) && list_skb); } while (memcmp(&msg->tag, this->cb, 4) && list_skb);
__skb_unlink(this, list);
spin_unlock_irqrestore(&list->lock, flags); spin_unlock_irqrestore(&list->lock, flags);
skb_unlink(this, &iucv_sk(sk)->send_skb_q);
kfree_skb(this); kfree_skb(this);
} }