Commit bfe9a6d7 authored by David S. Miller's avatar David S. Miller

Merge branch 'tipc-topology-server-fixes'

Parthasarathy Bhuvaragan says:

====================
tipc: topology server fixes

The following commits fixes two race conditions causing general
protection faults.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4eb6a3bd fd849b7c
...@@ -52,7 +52,6 @@ struct tipc_subscriber { ...@@ -52,7 +52,6 @@ struct tipc_subscriber {
struct list_head subscrp_list; struct list_head subscrp_list;
}; };
static void tipc_subscrp_delete(struct tipc_subscription *sub);
static void tipc_subscrb_put(struct tipc_subscriber *subscriber); static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
/** /**
...@@ -197,15 +196,19 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber, ...@@ -197,15 +196,19 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
{ {
struct list_head *subscription_list = &subscriber->subscrp_list; struct list_head *subscription_list = &subscriber->subscrp_list;
struct tipc_subscription *sub, *temp; struct tipc_subscription *sub, *temp;
u32 timeout;
spin_lock_bh(&subscriber->lock); spin_lock_bh(&subscriber->lock);
list_for_each_entry_safe(sub, temp, subscription_list, subscrp_list) { list_for_each_entry_safe(sub, temp, subscription_list, subscrp_list) {
if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
continue; continue;
timeout = htohl(sub->evt.s.timeout, sub->swap);
if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) {
tipc_nametbl_unsubscribe(sub); tipc_nametbl_unsubscribe(sub);
list_del(&sub->subscrp_list); list_del(&sub->subscrp_list);
tipc_subscrp_delete(sub); tipc_subscrp_put(sub);
}
if (s) if (s)
break; break;
...@@ -236,18 +239,12 @@ static void tipc_subscrb_delete(struct tipc_subscriber *subscriber) ...@@ -236,18 +239,12 @@ static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
tipc_subscrb_put(subscriber); tipc_subscrb_put(subscriber);
} }
static void tipc_subscrp_delete(struct tipc_subscription *sub)
{
u32 timeout = htohl(sub->evt.s.timeout, sub->swap);
if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer))
tipc_subscrp_put(sub);
}
static void tipc_subscrp_cancel(struct tipc_subscr *s, static void tipc_subscrp_cancel(struct tipc_subscr *s,
struct tipc_subscriber *subscriber) struct tipc_subscriber *subscriber)
{ {
tipc_subscrb_get(subscriber);
tipc_subscrb_subscrp_delete(subscriber, s); tipc_subscrb_subscrp_delete(subscriber, s);
tipc_subscrb_put(subscriber);
} }
static struct tipc_subscription *tipc_subscrp_create(struct net *net, static struct tipc_subscription *tipc_subscrp_create(struct net *net,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment