From patchwork Wed Dec 10 08:46:54 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Alpe X-Patchwork-Id: 419469 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E62AA1400B7 for ; Wed, 10 Dec 2014 19:51:27 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754120AbaLJIvX (ORCPT ); Wed, 10 Dec 2014 03:51:23 -0500 Received: from sesbmg23.ericsson.net ([193.180.251.37]:46898 "EHLO sesbmg23.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753477AbaLJIvV (ORCPT ); Wed, 10 Dec 2014 03:51:21 -0500 X-AuditID: c1b4fb25-f791c6d00000617b-c0-5488098000df Received: from ESESSHC011.ericsson.se (Unknown_Domain [153.88.253.124]) by sesbmg23.ericsson.net (Symantec Mail Security) with SMTP id 3B.EB.24955.08908845; Wed, 10 Dec 2014 09:51:12 +0100 (CET) Received: from tipsy.lab.linux.ericsson.se (10.35.28.120) by ESESSHC011.ericsson.se (153.88.183.51) with Microsoft SMTP Server (TLS) id 14.3.195.1; Wed, 10 Dec 2014 09:51:11 +0100 From: To: CC: , Richard Alpe , Erik Hugne Subject: [PATCH net-next] tipc: fix broadcast wakeup contention after congestion Date: Wed, 10 Dec 2014 09:46:54 +0100 Message-ID: <1418201214-30767-1-git-send-email-richard.alpe@ericsson.com> X-Mailer: git-send-email 2.1.3 MIME-Version: 1.0 X-Originating-IP: [10.35.28.120] X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLJMWRmVeSWpSXmKPExsUyM+JvjW4DZ0eIwd4mBYtjC8QstpzPcmDy 2L3gM5PH501yAUxRXDYpqTmZZalF+nYJXBm7unrYC84KVbQvncHUwPiXv4uRk0NCwERi9q3t bBC2mMSFe+uBbC4OIYEjjBJ7brxmhnC2M0o87bnC1MXIwcEmoChx5JkbSIOIgIzE0f4FYM3M ArUS/dc2gNnCAgES/fuWg9ksAqoSbUfvsYDYvAKeEm3Nf5lBxkgIyElsXecNERaUODnzCQvE GAmJgy9eMIPYQgJqEq03XjFD3KYg8W1mN9MERv5ZSFpmIWlZwMi0ilG0OLU4KTfdyFgvtSgz ubg4P08vL7VkEyMwvA5u+a26g/HyG8dDjAIcjEo8vAXv20OEWBPLiitzDzFKc7AoifMuPDcv WEggPbEkNTs1tSC1KL6oNCe1+BAjEwenVANjinvmyx0OkXNWPJsqkKqVVy476fpS/7tf/3jm HBf0SsvZ98r2YL/yoaNMCUIsDW75B88vc53g2dC18saMWoVpjRqGa/fkvImb3t64M1NGcqM3 0zLDX4FZkuvqGM40Nkz+vXJPydZ/kafObj80kdf1ybnZ0opVc0rnMeyzvHv668cllVw9a+// V2Ipzkg01GIuKk4EAEsWSmsQAgAA Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Richard Alpe commit 908344cdda80 ("tipc: fix bug in multicast congestion handling") introduced a race in the broadcast link wakeup functionality. This patch eliminates this broadcast link wakeup race caused by operation on the wakeup list without proper locking. If this race hit and corrupted the list all subsequent wakeup messages would be lost, resulting in a considerable memory leak. Signed-off-by: Richard Alpe Signed-off-by: Erik Hugne --- net/tipc/link.c | 8 ++++---- net/tipc/node.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/net/tipc/link.c b/net/tipc/link.c index 34bf15c..23bcc11 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -293,7 +293,7 @@ struct tipc_link *tipc_link_create(struct tipc_node *n_ptr, l_ptr->next_out_no = 1; __skb_queue_head_init(&l_ptr->outqueue); __skb_queue_head_init(&l_ptr->deferred_queue); - __skb_queue_head_init(&l_ptr->waiting_sks); + skb_queue_head_init(&l_ptr->waiting_sks); link_reset_statistics(l_ptr); @@ -358,7 +358,7 @@ static bool link_schedule_user(struct tipc_link *link, u32 oport, return false; TIPC_SKB_CB(buf)->chain_sz = chain_sz; TIPC_SKB_CB(buf)->chain_imp = imp; - __skb_queue_tail(&link->waiting_sks, buf); + skb_queue_tail(&link->waiting_sks, buf); link->stats.link_congs++; return true; } @@ -378,8 +378,8 @@ static void link_prepare_wakeup(struct tipc_link *link) if (pend_qsz >= link->queue_limit[TIPC_SKB_CB(skb)->chain_imp]) break; pend_qsz += TIPC_SKB_CB(skb)->chain_sz; - __skb_unlink(skb, &link->waiting_sks); - __skb_queue_tail(&link->owner->waiting_sks, skb); + skb_unlink(skb, &link->waiting_sks); + skb_queue_tail(&link->owner->waiting_sks, skb); } } diff --git a/net/tipc/node.c b/net/tipc/node.c index 69b96be..8d353ec 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -115,7 +115,7 @@ struct tipc_node *tipc_node_create(u32 addr) INIT_LIST_HEAD(&n_ptr->list); INIT_LIST_HEAD(&n_ptr->publ_list); INIT_LIST_HEAD(&n_ptr->conn_sks); - __skb_queue_head_init(&n_ptr->waiting_sks); + skb_queue_head_init(&n_ptr->waiting_sks); __skb_queue_head_init(&n_ptr->bclink.deferred_queue); hlist_add_head_rcu(&n_ptr->hash, &node_htable[tipc_hashfn(addr)]);