summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorParthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>2018-09-25 22:09:10 +0200
committerDavid S. Miller <davem@davemloft.net>2018-09-25 20:48:56 -0700
commit3f32d0be6c16b902b687453c962d17eea5b8ea19 (patch)
treeef7a97c7382acbb5499b3c3c7ff44ffccd5f08c0
parent94b6ddce71780575fbbf9d2c36afc8440e61a281 (diff)
tipc: lock wakeup & inputq at tipc_link_reset()
In tipc_link_reset() we copy the wakeup queue to input queue using skb_queue_splice_init(link->wakeupq, link->inputq). This is performed without holding any locks. The lists might be simultaneously be accessed by other cpu threads in tipc_sk_rcv(), something leading to to random missing packets. Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/tipc/link.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/net/tipc/link.c b/net/tipc/link.c
index b1f0bee54eac..26cc033ee167 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -841,9 +841,14 @@ void tipc_link_reset(struct tipc_link *l)
l->in_session = false;
l->session++;
l->mtu = l->advertised_mtu;
+ spin_lock_bh(&l->wakeupq.lock);
+ spin_lock_bh(&l->inputq->lock);
+ skb_queue_splice_init(&l->wakeupq, l->inputq);
+ spin_unlock_bh(&l->inputq->lock);
+ spin_unlock_bh(&l->wakeupq.lock);
+
__skb_queue_purge(&l->transmq);
__skb_queue_purge(&l->deferdq);
- skb_queue_splice_init(&l->wakeupq, l->inputq);
__skb_queue_purge(&l->backlogq);
l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;