| Message ID | 1453890959-8238-1-git-send-email-parthasarathy.bhuvaragan@ericsson.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Date: Wed, 27 Jan 2016 11:35:59 +0100 > In 'commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing > to events")', we terminate the connection if the subscription > creation fails. > In the same commit, the subscription creation result was based on > the value of the subscription pointer (set in the function) instead > of the return code. > > Unfortunately, the same function tipc_subscrp_create() handles > subscription cancel request. For a subscription cancellation request, > the subscription pointer cannot be set. Thus if a subscriber has > several subscriptions and cancels any of them, the connection is > terminated. > > In this commit, we terminate the connection based on the return value > of tipc_subscrp_create(). > Fixes: commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing to events") > > Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> > Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Applied and queued up for -stable, thanks.
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c index 350cca33ee0a..69ee2eeef968 100644 --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c @@ -289,15 +289,14 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid, struct sockaddr_tipc *addr, void *usr_data, void *buf, size_t len) { - struct tipc_subscriber *subscriber = usr_data; + struct tipc_subscriber *subscrb = usr_data; struct tipc_subscription *sub = NULL; struct tipc_net *tn = net_generic(net, tipc_net_id); - tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscriber, &sub); - if (sub) - tipc_nametbl_subscribe(sub); - else - tipc_conn_terminate(tn->topsrv, subscriber->conid); + if (tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscrb, &sub)) + return tipc_conn_terminate(tn->topsrv, subscrb->conid); + + tipc_nametbl_subscribe(sub); } /* Handle one request to establish a new subscriber */
In 'commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing to events")', we terminate the connection if the subscription creation fails. In the same commit, the subscription creation result was based on the value of the subscription pointer (set in the function) instead of the return code. Unfortunately, the same function tipc_subscrp_create() handles subscription cancel request. For a subscription cancellation request, the subscription pointer cannot be set. Thus if a subscriber has several subscriptions and cancels any of them, the connection is terminated. In this commit, we terminate the connection based on the return value of tipc_subscrp_create(). Fixes: commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing to events") Reviewed-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> --- v2: * Update variable subscriber to subscrb to fit the condition in single line as requested by Jon. net/tipc/subscr.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)