Commit 78dfb789 authored by Ying Xue's avatar Ying Xue Committed by David S. Miller

tipc: acquire necessary locks in named_cluster_distribute routine

The 'tipc_node_list' is guarded by tipc_net_lock and 'links' array
defined in 'tipc_node' structure is protected by node lock as well.
Without acquiring the two locks in named_cluster_distribute() a fatal
oops may happen in case that a destroyed link might be got and then
accessed. Therefore, above mentioned two locks must be held in
named_cluster_distribute() to prevent the issue from happening
accidentally.

As 'links' array in node struct must be protected by node lock,
we have to move the code of selecting an active link from
tipc_link_xmit() to named_cluster_distribute() and then call
__tipc_link_xmit() with the selected link to deliver name messages.
Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
Reviewed-by: default avatarErik Hugne <erik.hugne@ericsson.com>
Reviewed-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5902385a
...@@ -131,16 +131,24 @@ static void named_cluster_distribute(struct sk_buff *buf) ...@@ -131,16 +131,24 @@ static void named_cluster_distribute(struct sk_buff *buf)
{ {
struct sk_buff *buf_copy; struct sk_buff *buf_copy;
struct tipc_node *n_ptr; struct tipc_node *n_ptr;
struct tipc_link *l_ptr;
read_lock_bh(&tipc_net_lock);
list_for_each_entry(n_ptr, &tipc_node_list, list) { list_for_each_entry(n_ptr, &tipc_node_list, list) {
if (tipc_node_active_links(n_ptr)) { spin_lock_bh(&n_ptr->lock);
l_ptr = n_ptr->active_links[n_ptr->addr & 1];
if (l_ptr) {
buf_copy = skb_copy(buf, GFP_ATOMIC); buf_copy = skb_copy(buf, GFP_ATOMIC);
if (!buf_copy) if (!buf_copy) {
spin_unlock_bh(&n_ptr->lock);
break; break;
}
msg_set_destnode(buf_msg(buf_copy), n_ptr->addr); msg_set_destnode(buf_msg(buf_copy), n_ptr->addr);
tipc_link_xmit(buf_copy, n_ptr->addr, n_ptr->addr); __tipc_link_xmit(l_ptr, buf_copy);
} }
spin_unlock_bh(&n_ptr->lock);
} }
read_unlock_bh(&tipc_net_lock);
kfree_skb(buf); kfree_skb(buf);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment