Commit 4a7d99ea authored by Basil Gunn's avatar Basil Gunn Committed by David S. Miller

AX.25: Close socket connection on session completion

A socket connection made in ax.25 is not closed when session is
completed.  The heartbeat timer is stopped prematurely and this is
where the socket gets closed. Allow heatbeat timer to run to close
socket. Symptom occurs in kernels >= 4.2.0

Originally sent 6/15/2016. Resend with distribution list matching
scripts/maintainer.pl output.
Signed-off-by: default avatarBasil Gunn <basil@pacabunga.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3bb549ae
...@@ -976,6 +976,7 @@ static int ax25_release(struct socket *sock) ...@@ -976,6 +976,7 @@ static int ax25_release(struct socket *sock)
release_sock(sk); release_sock(sk);
ax25_disconnect(ax25, 0); ax25_disconnect(ax25, 0);
lock_sock(sk); lock_sock(sk);
if (!sock_flag(ax25->sk, SOCK_DESTROY))
ax25_destroy_socket(ax25); ax25_destroy_socket(ax25);
break; break;
......
...@@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) ...@@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
switch (ax25->state) { switch (ax25->state) {
case AX25_STATE_0: case AX25_STATE_0:
case AX25_STATE_2:
/* Magic here: If we listen() and a new link dies before it /* Magic here: If we listen() and a new link dies before it
is accepted() it isn't 'dead' so doesn't get removed. */ is accepted() it isn't 'dead' so doesn't get removed. */
if (!sk || sock_flag(sk, SOCK_DESTROY) || if (!sk || sock_flag(sk, SOCK_DESTROY) ||
...@@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25) ...@@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
sock_hold(sk); sock_hold(sk);
ax25_destroy_socket(ax25); ax25_destroy_socket(ax25);
bh_unlock_sock(sk); bh_unlock_sock(sk);
/* Ungrab socket and destroy it */
sock_put(sk); sock_put(sk);
} else } else
ax25_destroy_socket(ax25); ax25_destroy_socket(ax25);
...@@ -213,6 +215,7 @@ void ax25_ds_t1_timeout(ax25_cb *ax25) ...@@ -213,6 +215,7 @@ void ax25_ds_t1_timeout(ax25_cb *ax25)
case AX25_STATE_2: case AX25_STATE_2:
if (ax25->n2count == ax25->n2) { if (ax25->n2count == ax25->n2) {
ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
if (!sock_flag(ax25->sk, SOCK_DESTROY))
ax25_disconnect(ax25, ETIMEDOUT); ax25_disconnect(ax25, ETIMEDOUT);
return; return;
} else { } else {
......
...@@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) ...@@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
switch (ax25->state) { switch (ax25->state) {
case AX25_STATE_0: case AX25_STATE_0:
case AX25_STATE_2:
/* Magic here: If we listen() and a new link dies before it /* Magic here: If we listen() and a new link dies before it
is accepted() it isn't 'dead' so doesn't get removed. */ is accepted() it isn't 'dead' so doesn't get removed. */
if (!sk || sock_flag(sk, SOCK_DESTROY) || if (!sk || sock_flag(sk, SOCK_DESTROY) ||
...@@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25) ...@@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
sock_hold(sk); sock_hold(sk);
ax25_destroy_socket(ax25); ax25_destroy_socket(ax25);
bh_unlock_sock(sk); bh_unlock_sock(sk);
/* Ungrab socket and destroy it */
sock_put(sk); sock_put(sk);
} else } else
ax25_destroy_socket(ax25); ax25_destroy_socket(ax25);
...@@ -144,6 +146,7 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25) ...@@ -144,6 +146,7 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25)
case AX25_STATE_2: case AX25_STATE_2:
if (ax25->n2count == ax25->n2) { if (ax25->n2count == ax25->n2) {
ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND); ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
if (!sock_flag(ax25->sk, SOCK_DESTROY))
ax25_disconnect(ax25, ETIMEDOUT); ax25_disconnect(ax25, ETIMEDOUT);
return; return;
} else { } else {
......
...@@ -264,6 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason) ...@@ -264,6 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
{ {
ax25_clear_queues(ax25); ax25_clear_queues(ax25);
if (!sock_flag(ax25->sk, SOCK_DESTROY))
ax25_stop_heartbeat(ax25); ax25_stop_heartbeat(ax25);
ax25_stop_t1timer(ax25); ax25_stop_t1timer(ax25);
ax25_stop_t2timer(ax25); ax25_stop_t2timer(ax25);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment