Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28dd9418 authored by Ying Xue's avatar Ying Xue Committed by David S. Miller
Browse files

tipc: use bc_lock to protect node map in bearer structure 



The node map variable - 'nodes' in bearer structure is only used by
bclink. When bclink accesses it, bc_lock is held. But when change it,
for instance, in tipc_bearer_add_dest() or tipc_bearer_remove_dest()
the bc_lock is not taken at all. To avoid any inconsistent data, we
should always grab bc_lock while accessing node map variable.

Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
Reviewed-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Reviewed-by: default avatarErik Hugne <erik.hugne@ericsson.com>
Tested-by: default avatarErik Hugne <erik.hugne@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4ae88c94

net/tipc/bcast.c

+10 −4
Original line number Original line Diff line number Diff line
@@ -112,6 +112,8 @@ const char tipc_bclink_name[] = "broadcast-link"; 
static void tipc_nmap_diff(struct tipc_node_map *nm_a,

static void tipc_nmap_diff(struct tipc_node_map *nm_a,

			   struct tipc_node_map *nm_b,

			   struct tipc_node_map *nm_b,

			   struct tipc_node_map *nm_diff);

			   struct tipc_node_map *nm_diff);

static void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node);

static void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node);





static u32 bcbuf_acks(struct sk_buff *buf)

static u32 bcbuf_acks(struct sk_buff *buf)

{

{
@@ -653,7 +655,7 @@ static int tipc_bcbearer_send(struct sk_buff *buf, struct tipc_bearer *unused1, 
/**

/**

 * tipc_bcbearer_sort - create sets of bearer pairs used by broadcast bearer

 * tipc_bcbearer_sort - create sets of bearer pairs used by broadcast bearer

 */

 */

void tipc_bcbearer_sort(void)

void tipc_bcbearer_sort(struct tipc_node_map *nm_ptr, u32 node, bool action)

{

{

	struct tipc_bcbearer_pair *bp_temp = bcbearer->bpairs_temp;

	struct tipc_bcbearer_pair *bp_temp = bcbearer->bpairs_temp;

	struct tipc_bcbearer_pair *bp_curr;

	struct tipc_bcbearer_pair *bp_curr;
@@ -663,6 +665,11 @@ void tipc_bcbearer_sort(void) 




	spin_lock_bh(&bc_lock);

	spin_lock_bh(&bc_lock);





	if (action)

		tipc_nmap_add(nm_ptr, node);

	else

		tipc_nmap_remove(nm_ptr, node);



	/* Group bearers by priority (can assume max of two per priority) */

	/* Group bearers by priority (can assume max of two per priority) */

	memset(bp_temp, 0, sizeof(bcbearer->bpairs_temp));

	memset(bp_temp, 0, sizeof(bcbearer->bpairs_temp));
@@ -801,11 +808,10 @@ void tipc_bclink_stop(void) 
	memset(bcbearer, 0, sizeof(*bcbearer));

	memset(bcbearer, 0, sizeof(*bcbearer));

}

}







/**

/**

 * tipc_nmap_add - add a node to a node map

 * tipc_nmap_add - add a node to a node map

 */

 */

void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node)

static void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node)

{

{

	int n = tipc_node(node);

	int n = tipc_node(node);

	int w = n / WSIZE;

	int w = n / WSIZE;
@@ -820,7 +826,7 @@ void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node) 
/**

/**

 * tipc_nmap_remove - remove a node from a node map

 * tipc_nmap_remove - remove a node from a node map

 */

 */

void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node)

static void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node)

{

{

	int n = tipc_node(node);

	int n = tipc_node(node);

	int w = n / WSIZE;

	int w = n / WSIZE;

net/tipc/bcast.h

+1 −4
Original line number Original line Diff line number Diff line
@@ -69,9 +69,6 @@ struct tipc_node; 




extern const char tipc_bclink_name[];

extern const char tipc_bclink_name[];





void tipc_nmap_add(struct tipc_node_map *nm_ptr, u32 node);

void tipc_nmap_remove(struct tipc_node_map *nm_ptr, u32 node);



/**

/**

 * tipc_nmap_equal - test for equality of node maps

 * tipc_nmap_equal - test for equality of node maps

 */

 */
@@ -98,6 +95,6 @@ void tipc_bclink_update_link_state(struct tipc_node *n_ptr, u32 last_sent); 
int  tipc_bclink_stats(char *stats_buf, const u32 buf_size);

int  tipc_bclink_stats(char *stats_buf, const u32 buf_size);

int  tipc_bclink_reset_stats(void);

int  tipc_bclink_reset_stats(void);

int  tipc_bclink_set_queue_limits(u32 limit);

int  tipc_bclink_set_queue_limits(u32 limit);

void tipc_bcbearer_sort(void);

void tipc_bcbearer_sort(struct tipc_node_map *nm_ptr, u32 node, bool action);





#endif
 
#endif

net/tipc/bearer.c

+2 −4
Original line number Original line Diff line number Diff line
@@ -220,8 +220,7 @@ void tipc_bearer_add_dest(u32 bearer_id, u32 dest) 
	rcu_read_lock();

	rcu_read_lock();

	b_ptr = rcu_dereference_rtnl(bearer_list[bearer_id]);

	b_ptr = rcu_dereference_rtnl(bearer_list[bearer_id]);

	if (b_ptr) {

	if (b_ptr) {

		tipc_nmap_add(&b_ptr->nodes, dest);

		tipc_bcbearer_sort(&b_ptr->nodes, dest, true);

		tipc_bcbearer_sort();

		tipc_disc_add_dest(b_ptr->link_req);

		tipc_disc_add_dest(b_ptr->link_req);

	}

	}

	rcu_read_unlock();

	rcu_read_unlock();
@@ -234,8 +233,7 @@ void tipc_bearer_remove_dest(u32 bearer_id, u32 dest) 
	rcu_read_lock();

	rcu_read_lock();

	b_ptr = rcu_dereference_rtnl(bearer_list[bearer_id]);

	b_ptr = rcu_dereference_rtnl(bearer_list[bearer_id]);

	if (b_ptr) {

	if (b_ptr) {

		tipc_nmap_remove(&b_ptr->nodes, dest);

		tipc_bcbearer_sort(&b_ptr->nodes, dest, false);

		tipc_bcbearer_sort();

		tipc_disc_remove_dest(b_ptr->link_req);

		tipc_disc_remove_dest(b_ptr->link_req);

	}

	}

	rcu_read_unlock();

	rcu_read_unlock();