diff options
| author |  David S. Miller <davem@davemloft.net>
| 2017-08-22 14:25:02 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net>
| 2017-08-22 14:25:02 -0700 |
| commit | bfe9a6d76a15e1b1deb465d25876217d7ca35097 (patch) | |
| tree | 1770d59f0cb5c75332f06e843696ce902377542d | |
| parent | mlxsw: spectrum_switchdev: Fix mrouter flag update (diff) | |
| parent | tipc: fix a race condition of releasing subscriber object (diff) | |
| download | linux-bfe9a6d76a15e1b1deb465d25876217d7ca35097.tar.gz linux-bfe9a6d76a15e1b1deb465d25876217d7ca35097.tar.bz2 linux-bfe9a6d76a15e1b1deb465d25876217d7ca35097.zip | |
Merge branch 'tipc-topology-server-fixes'
Parthasarathy Bhuvaragan says:
====================
tipc: topology server fixes
The following commits fixes two race conditions causing general
protection faults.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tipc/subscr.c | 21 |
1 files changed, 9 insertions, 12 deletions
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c index 0bf91cd3733c..be3d9e3183dc 100644 --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c @@ -52,7 +52,6 @@ struct tipc_subscriber { struct list_head subscrp_list; }; -static void tipc_subscrp_delete(struct tipc_subscription *sub); static void tipc_subscrb_put(struct tipc_subscriber *subscriber); /** @@ -197,15 +196,19 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber, { struct list_head *subscription_list = &subscriber->subscrp_list; struct tipc_subscription *sub, *temp; + u32 timeout; spin_lock_bh(&subscriber->lock); list_for_each_entry_safe(sub, temp, subscription_list, subscrp_list) { if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) continue; - tipc_nametbl_unsubscribe(sub); - list_del(&sub->subscrp_list); - tipc_subscrp_delete(sub); + timeout = htohl(sub->evt.s.timeout, sub->swap); + if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) { + tipc_nametbl_unsubscribe(sub); + list_del(&sub->subscrp_list); + tipc_subscrp_put(sub); + } if (s) break; @@ -236,18 +239,12 @@ static void tipc_subscrb_delete(struct tipc_subscriber *subscriber) tipc_subscrb_put(subscriber); } -static void tipc_subscrp_delete(struct tipc_subscription *sub) -{ - u32 timeout = htohl(sub->evt.s.timeout, sub->swap); - - if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) - tipc_subscrp_put(sub); -} - static void tipc_subscrp_cancel(struct tipc_subscr *s, struct tipc_subscriber *subscriber) { + tipc_subscrb_get(subscriber); tipc_subscrb_subscrp_delete(subscriber, s); + tipc_subscrb_put(subscriber); } static struct tipc_subscription *tipc_subscrp_create(struct net *net, |