Commit 340b6e59 authored by Richard Alpe's avatar Richard Alpe Committed by David S. Miller

tipc: fix broadcast wakeup contention after congestion

commit 908344cd ("tipc: fix bug in multicast congestion handling")
introduced a race in the broadcast link wakeup functionality.

This patch eliminates this broadcast link wakeup race caused by
operation on the wakeup list without proper locking. If this race
hit and corrupted the list all subsequent wakeup messages would be
lost, resulting in a considerable memory leak.
Signed-off-by: default avatarRichard Alpe <richard.alpe@ericsson.com>
Signed-off-by: default avatarErik Hugne <erik.hugne@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4f675eb2
...@@ -293,7 +293,7 @@ struct tipc_link *tipc_link_create(struct tipc_node *n_ptr, ...@@ -293,7 +293,7 @@ struct tipc_link *tipc_link_create(struct tipc_node *n_ptr,
l_ptr->next_out_no = 1; l_ptr->next_out_no = 1;
__skb_queue_head_init(&l_ptr->outqueue); __skb_queue_head_init(&l_ptr->outqueue);
__skb_queue_head_init(&l_ptr->deferred_queue); __skb_queue_head_init(&l_ptr->deferred_queue);
__skb_queue_head_init(&l_ptr->waiting_sks); skb_queue_head_init(&l_ptr->waiting_sks);
link_reset_statistics(l_ptr); link_reset_statistics(l_ptr);
...@@ -358,7 +358,7 @@ static bool link_schedule_user(struct tipc_link *link, u32 oport, ...@@ -358,7 +358,7 @@ static bool link_schedule_user(struct tipc_link *link, u32 oport,
return false; return false;
TIPC_SKB_CB(buf)->chain_sz = chain_sz; TIPC_SKB_CB(buf)->chain_sz = chain_sz;
TIPC_SKB_CB(buf)->chain_imp = imp; TIPC_SKB_CB(buf)->chain_imp = imp;
__skb_queue_tail(&link->waiting_sks, buf); skb_queue_tail(&link->waiting_sks, buf);
link->stats.link_congs++; link->stats.link_congs++;
return true; return true;
} }
...@@ -378,8 +378,8 @@ static void link_prepare_wakeup(struct tipc_link *link) ...@@ -378,8 +378,8 @@ static void link_prepare_wakeup(struct tipc_link *link)
if (pend_qsz >= link->queue_limit[TIPC_SKB_CB(skb)->chain_imp]) if (pend_qsz >= link->queue_limit[TIPC_SKB_CB(skb)->chain_imp])
break; break;
pend_qsz += TIPC_SKB_CB(skb)->chain_sz; pend_qsz += TIPC_SKB_CB(skb)->chain_sz;
__skb_unlink(skb, &link->waiting_sks); skb_unlink(skb, &link->waiting_sks);
__skb_queue_tail(&link->owner->waiting_sks, skb); skb_queue_tail(&link->owner->waiting_sks, skb);
} }
} }
......
...@@ -115,7 +115,7 @@ struct tipc_node *tipc_node_create(u32 addr) ...@@ -115,7 +115,7 @@ struct tipc_node *tipc_node_create(u32 addr)
INIT_LIST_HEAD(&n_ptr->list); INIT_LIST_HEAD(&n_ptr->list);
INIT_LIST_HEAD(&n_ptr->publ_list); INIT_LIST_HEAD(&n_ptr->publ_list);
INIT_LIST_HEAD(&n_ptr->conn_sks); INIT_LIST_HEAD(&n_ptr->conn_sks);
__skb_queue_head_init(&n_ptr->waiting_sks); skb_queue_head_init(&n_ptr->waiting_sks);
__skb_queue_head_init(&n_ptr->bclink.deferred_queue); __skb_queue_head_init(&n_ptr->bclink.deferred_queue);
hlist_add_head_rcu(&n_ptr->hash, &node_htable[tipc_hashfn(addr)]); hlist_add_head_rcu(&n_ptr->hash, &node_htable[tipc_hashfn(addr)]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment