]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
tipc: lock wakeup & inputq at tipc_link_reset()
authorParthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Tue, 25 Sep 2018 20:09:10 +0000 (22:09 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 26 Sep 2018 03:48:56 +0000 (20:48 -0700)
In tipc_link_reset() we copy the wakeup queue to input queue using
skb_queue_splice_init(link->wakeupq, link->inputq).
This is performed without holding any locks. The lists might be
simultaneously be accessed by other cpu threads in tipc_sk_rcv(),
something leading to to random missing packets.

Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/link.c

index b1f0bee54eacc9eb1974169853abf1ace4df2733..26cc033ee167591d186ecfbb5a6fbbb87d6c6d10 100644 (file)
@@ -841,9 +841,14 @@ void tipc_link_reset(struct tipc_link *l)
        l->in_session = false;
        l->session++;
        l->mtu = l->advertised_mtu;
+       spin_lock_bh(&l->wakeupq.lock);
+       spin_lock_bh(&l->inputq->lock);
+       skb_queue_splice_init(&l->wakeupq, l->inputq);
+       spin_unlock_bh(&l->inputq->lock);
+       spin_unlock_bh(&l->wakeupq.lock);
+
        __skb_queue_purge(&l->transmq);
        __skb_queue_purge(&l->deferdq);
-       skb_queue_splice_init(&l->wakeupq, l->inputq);
        __skb_queue_purge(&l->backlogq);
        l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
        l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;