Commit 01462405 authored Nov 19, 2014 by Jiri Bohac Committed by David S. Miller Nov 20, 2014

ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg



This fixes an old regression introduced by commit
b0d0d915 (ipx: remove the BKL).

When a recvmsg syscall blocks waiting for new data, no data can be sent on the
same socket with sendmsg because ipx_recvmsg() sleeps with the socket locked.

This breaks mars-nwe (NetWare emulator):
- the ncpserv process reads the request using recvmsg
- ncpserv forks and spawns nwconn
- ncpserv calls a (blocking) recvmsg and waits for new requests
- nwconn deadlocks in sendmsg on the same socket

Commit b0d0d915 has simply replaced BKL locking with
lock_sock/release_sock. Unlike now, BKL got unlocked while
sleeping, so a blocking recvmsg did not block a concurrent
sendmsg.

Only keep the socket locked while actually working with the socket data and
release it prior to calling skb_recv_datagram().

Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d3052bb5

net/ipx/af_ipx.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -1764,6 +1764,7 @@ static int ipx_recvmsg(struct kiocb iocb, struct socket sock,
		struct ipxhdr *ipx = NULL;
		struct sk_buff *skb;
		int copied, rc;
		bool locked = true;

		lock_sock(sk);
		/* put the autobinding in */
		@@ -1790,6 +1791,8 @@ static int ipx_recvmsg(struct kiocb iocb, struct socket sock,
		if (sock_flag(sk, SOCK_ZAPPED))
		goto out;

		release_sock(sk);
		locked = false;
		skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
		flags & MSG_DONTWAIT, &rc);
		if (!skb) {
		@@ -1826,6 +1829,7 @@ static int ipx_recvmsg(struct kiocb iocb, struct socket sock,
		out_free:
		skb_free_datagram(sk, skb);
		out:
		if (locked)
		release_sock(sk);
		return rc;
		}