Commit c57e51ff authored by Parthasarathy Bhuvaragan's avatar Parthasarathy Bhuvaragan Committed by Greg Kroah-Hartman

tipc: fix connection abort during subscription cancel

[ Upstream commit 4d5cfcba ]

In 'commit 7fe8097c ("tipc: fix nullpointer bug when subscribing
to events")', we terminate the connection if the subscription
creation fails.
In the same commit, the subscription creation result was based on
the value of the subscription pointer (set in the function) instead
of the return code.

Unfortunately, the same function tipc_subscrp_create() handles
subscription cancel request. For a subscription cancellation request,
the subscription pointer cannot be set. Thus if a subscriber has
several subscriptions and cancels any of them, the connection is
terminated.

In this commit, we terminate the connection based on the return value
of tipc_subscrp_create().
Fixes: commit 7fe8097c ("tipc: fix nullpointer bug when subscribing to events")
Reviewed-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarParthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7f76933d
...@@ -289,15 +289,14 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid, ...@@ -289,15 +289,14 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid,
struct sockaddr_tipc *addr, void *usr_data, struct sockaddr_tipc *addr, void *usr_data,
void *buf, size_t len) void *buf, size_t len)
{ {
struct tipc_subscriber *subscriber = usr_data; struct tipc_subscriber *subscrb = usr_data;
struct tipc_subscription *sub = NULL; struct tipc_subscription *sub = NULL;
struct tipc_net *tn = net_generic(net, tipc_net_id); struct tipc_net *tn = net_generic(net, tipc_net_id);
tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscriber, &sub); if (tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscrb, &sub))
if (sub) return tipc_conn_terminate(tn->topsrv, subscrb->conid);
tipc_nametbl_subscribe(sub); tipc_nametbl_subscribe(sub);
else
tipc_conn_terminate(tn->topsrv, subscriber->conid);
} }
/* Handle one request to establish a new subscriber */ /* Handle one request to establish a new subscriber */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment