• Jon Paul Maloy's avatar
    tipc: fix two bugs in secondary destination lookup · d482994f
    Jon Paul Maloy authored
    A message sent to a node after a successful name table lookup may still
    find that the destination socket has disappeared, because distribution
    of name table updates is non-atomic. If so, the message will be rejected
    back to the sender with error code TIPC_ERR_NO_PORT. If the source
    socket of the message has disappeared in the meantime, the message
    should be dropped.
    
    However, in the currrent code, the message will instead be subject to an
    unwanted tertiary lookup, because the function tipc_msg_lookup_dest()
    doesn't check if there is an error code present in the message before
    performing the lookup. In the worst case, the message may now find the
    old destination again, and be redirected once more, instead of being
    dropped directly as it should be.
    
    A second bug in this function is that the "prev_node" field in the message
    is not updated after successful lookup, something that may have
    unpredictable consequences.
    
    The problems arising from those bugs occur very infrequently.
    
    The third change in this function; the test on msg_reroute_msg_cnt() is
    purely cosmetic, reflecting that the returned value never can be negative.
    
    This commit corrects the two bugs described above.
    Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d482994f
msg.c 15.4 KB