Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4444722 authored by Ursula Braun's avatar Ursula Braun Committed by David S. Miller
Browse files

[AF_IUCV]: broken send_skb_q results in endless loop 



A race has been detected in iucv_callback_txdone().
skb_unlink has to be done inside the locked area.

In addition checkings for successful allocations are inserted.

Signed-off-by: default avatarUrsula Braun <braunu@de.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 435bc9df

net/iucv/af_iucv.c

+7 −1
Original line number Diff line number Diff line
@@ -482,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr, 
	/* Create path. */

	iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,

				     IPRMDATA, GFP_KERNEL);

	if (!iucv->path) {

		err = -ENOMEM;

		goto done;

	}

	err = iucv_path_connect(iucv->path, &af_iucv_handler,

				sa->siucv_user_id, NULL, user_data, sk);

	if (err) {
@@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg) 


save_message:

	save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);

	if (!save_msg)

		return;

	save_msg->path = path;

	save_msg->msg = *msg;
@@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path, 
			this = list_skb;

			list_skb = list_skb->next;

		} while (memcmp(&msg->tag, this->cb, 4) && list_skb);

		__skb_unlink(this, list);



		spin_unlock_irqrestore(&list->lock, flags);



		skb_unlink(this, &iucv_sk(sk)->send_skb_q);

		kfree_skb(this);

	}