diff options
| author | Ursula Braun <braunu@de.ibm.com> | 2008-02-07 18:07:19 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-02-07 18:07:19 -0800 |
| commit | d44447229e35115675d166b51a52e512c281475c (patch) | |
| tree | b968431fddcbb21fe0c3278c7545c22bdc2be4a4 /net/iucv | |
| parent | 435bc9dfc6927eed9465e297d7aca1217aa61956 (diff) | |
| download | kernel_samsung_aries-d44447229e35115675d166b51a52e512c281475c.zip kernel_samsung_aries-d44447229e35115675d166b51a52e512c281475c.tar.gz kernel_samsung_aries-d44447229e35115675d166b51a52e512c281475c.tar.bz2 | |
[AF_IUCV]: broken send_skb_q results in endless loop
A race has been detected in iucv_callback_txdone().
skb_unlink has to be done inside the locked area.
In addition checkings for successful allocations are inserted.
Signed-off-by: Ursula Braun <braunu@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/iucv')
| -rw-r--r-- | net/iucv/af_iucv.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index 2255e3c..b3f5f84 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -482,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr, /* Create path. */ iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT, IPRMDATA, GFP_KERNEL); + if (!iucv->path) { + err = -ENOMEM; + goto done; + } err = iucv_path_connect(iucv->path, &af_iucv_handler, sa->siucv_user_id, NULL, user_data, sk); if (err) { @@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg) save_message: save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA); + if (!save_msg) + return; save_msg->path = path; save_msg->msg = *msg; @@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path, this = list_skb; list_skb = list_skb->next; } while (memcmp(&msg->tag, this->cb, 4) && list_skb); + __skb_unlink(this, list); spin_unlock_irqrestore(&list->lock, flags); - skb_unlink(this, &iucv_sk(sk)->send_skb_q); kfree_skb(this); } |