Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0ebb739 authored by Patrick McHardy's avatar Patrick McHardy
Browse files

ipv4: ipmr: fix invalid cache resolving when adding a non-matching entry 



The patch to convert struct mfc_cache to list_heads (ipv4: ipmr: convert
struct mfc_cache to struct list_head) introduced a bug when adding new
cache entries that don't match any unresolved entries.

The unres queue is searched for a matching entry, which is then resolved.
When no matching entry is present, the iterator points to the head of the
list, but is treated as a matching entry. Use a seperate variable to
indicate that a matching entry was found.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 66496d49

net/ipv4/ipmr.c

+3 −1
Original line number Diff line number Diff line
@@ -1089,12 +1089,14 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt, 
	 *	Check to see if we resolved a queued list. If so we

	 *	need to send on the frames and tidy up.

	 */

	found = false;

	spin_lock_bh(&mfc_unres_lock);

	list_for_each_entry(uc, &mrt->mfc_unres_queue, list) {

		if (uc->mfc_origin == c->mfc_origin &&

		    uc->mfc_mcastgrp == c->mfc_mcastgrp) {

			list_del(&uc->list);

			atomic_dec(&mrt->cache_resolve_queue_len);

			found = true;

			break;

		}

	}
@@ -1102,7 +1104,7 @@ static int ipmr_mfc_add(struct net *net, struct mr_table *mrt, 
		del_timer(&mrt->ipmr_expire_timer);

	spin_unlock_bh(&mfc_unres_lock);



	if (uc) {

	if (found) {

		ipmr_cache_resolve(net, mrt, uc, c);

		ipmr_cache_free(uc);

	}