diff mbox

[net-next] tipc: fix missing spinlock init and nullptr oops

Message ID 1417622320-19730-1-git-send-email-erik.hugne@ericsson.com
State Rejected, archived
Headers show

Commit Message

Erik Hugne Dec. 3, 2014, 3:58 p.m. UTC
From: Erik Hugne <erik.hugne@ericsson.com>

commit 908344cdda80 ("tipc: fix bug in multicast congestion
handling") introduced two bugs with the bclink wakeup
function. This commit fixes the missing spinlock init for the
waiting_sks list. We also eliminate the race condition
between the waiting_sks length check/dequeue operations in
tipc_bclink_wakeup_users by simply removing the redundant
length check.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Acked-by: Tero Aho <Tero.Aho@coriant.com>
---
 net/tipc/bcast.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

Comments

Erik Hugne Dec. 5, 2014, 12:39 p.m. UTC | #1
On Wed, Dec 03, 2014 at 04:58:40PM +0100, erik.hugne@ericsson.com wrote:
> From: Erik Hugne <erik.hugne@ericsson.com>
> 
> commit 908344cdda80 ("tipc: fix bug in multicast congestion
> handling") introduced two bugs with the bclink wakeup
> function. This commit fixes the missing spinlock init for the
> waiting_sks list. We also eliminate the race condition
> between the waiting_sks length check/dequeue operations in
> tipc_bclink_wakeup_users by simply removing the redundant
> length check.
> 
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> Acked-by: Tero Aho <Tero.Aho@coriant.com>

Richard found another issue during regression testing closely related
to this, I have dropped it from patchwork and he will send in
v2.

//E
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Dec. 9, 2014, 6:42 p.m. UTC | #2
From: <erik.hugne@ericsson.com>
Date: Wed, 3 Dec 2014 16:58:40 +0100

> From: Erik Hugne <erik.hugne@ericsson.com>
> 
> commit 908344cdda80 ("tipc: fix bug in multicast congestion
> handling") introduced two bugs with the bclink wakeup
> function. This commit fixes the missing spinlock init for the
> waiting_sks list. We also eliminate the race condition
> between the waiting_sks length check/dequeue operations in
> tipc_bclink_wakeup_users by simply removing the redundant
> length check.
> 
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> Acked-by: Tero Aho <Tero.Aho@coriant.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index f0761c7..96ceefe 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -233,8 +233,11 @@  static void bclink_retransmit_pkt(u32 after, u32 to)
  */
 void tipc_bclink_wakeup_users(void)
 {
-	while (skb_queue_len(&bclink->link.waiting_sks))
-		tipc_sk_rcv(skb_dequeue(&bclink->link.waiting_sks));
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(&bclink->link.waiting_sks)))
+		tipc_sk_rcv(skb);
+
 }
 
 /**
@@ -950,7 +953,7 @@  int tipc_bclink_init(void)
 	spin_lock_init(&bclink->lock);
 	__skb_queue_head_init(&bcl->outqueue);
 	__skb_queue_head_init(&bcl->deferred_queue);
-	__skb_queue_head_init(&bcl->waiting_sks);
+	skb_queue_head_init(&bcl->waiting_sks);
 	bcl->next_out_no = 1;
 	spin_lock_init(&bclink->node.lock);
 	__skb_queue_head_init(&bclink->node.waiting_sks);