Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=94571065757a4f2619c48ab4e36cafdc635028ce
Commit:     94571065757a4f2619c48ab4e36cafdc635028ce
Parent:     0ed72ec4afb9fbd584e03763707d3db0f62ee1be
Author:     Florian Westphal <[EMAIL PROTECTED]>
AuthorDate: Thu Jul 26 00:05:07 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Jul 31 02:28:02 2007 -0700

    [TIPC]: fix tipc_link_create error handling
    
    if printbuf allocation or tipc_node_attach_link() fails, invalid
    references to the link are left in the associated node and bearer
    structures.
    Fix by allocating printbuf early and moving timer initialization
    and the addition of the new link to the b_ptr->links list after
    tipc_node_attach_link() succeeded.
    
    Signed-off-by: Florian Westphal <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/tipc/link.c |   28 +++++++++++++++-------------
 1 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 5adfdfd..1d674e0 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -423,6 +423,17 @@ struct link *tipc_link_create(struct bearer *b_ptr, const 
u32 peer,
                return NULL;
        }
 
+       if (LINK_LOG_BUF_SIZE) {
+               char *pb = kmalloc(LINK_LOG_BUF_SIZE, GFP_ATOMIC);
+
+               if (!pb) {
+                       kfree(l_ptr);
+                       warn("Link creation failed, no memory for print 
buffer\n");
+                       return NULL;
+               }
+               tipc_printbuf_init(&l_ptr->print_buf, pb, LINK_LOG_BUF_SIZE);
+       }
+
        l_ptr->addr = peer;
        if_name = strchr(b_ptr->publ.name, ':') + 1;
        sprintf(l_ptr->name, "%u.%u.%u:%s-%u.%u.%u:",
@@ -432,8 +443,6 @@ struct link *tipc_link_create(struct bearer *b_ptr, const 
u32 peer,
                tipc_zone(peer), tipc_cluster(peer), tipc_node(peer));
                /* note: peer i/f is appended to link name by reset/activate */
        memcpy(&l_ptr->media_addr, media_addr, sizeof(*media_addr));
-       k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned 
long)l_ptr);
-       list_add_tail(&l_ptr->link_list, &b_ptr->links);
        l_ptr->checkpoint = 1;
        l_ptr->b_ptr = b_ptr;
        link_set_supervision_props(l_ptr, b_ptr->media->tolerance);
@@ -459,21 +468,14 @@ struct link *tipc_link_create(struct bearer *b_ptr, const 
u32 peer,
 
        l_ptr->owner = tipc_node_attach_link(l_ptr);
        if (!l_ptr->owner) {
+               if (LINK_LOG_BUF_SIZE)
+                       kfree(l_ptr->print_buf.buf);
                kfree(l_ptr);
                return NULL;
        }
 
-       if (LINK_LOG_BUF_SIZE) {
-               char *pb = kmalloc(LINK_LOG_BUF_SIZE, GFP_ATOMIC);
-
-               if (!pb) {
-                       kfree(l_ptr);
-                       warn("Link creation failed, no memory for print 
buffer\n");
-                       return NULL;
-               }
-               tipc_printbuf_init(&l_ptr->print_buf, pb, LINK_LOG_BUF_SIZE);
-       }
-
+       k_init_timer(&l_ptr->timer, (Handler)link_timeout, (unsigned 
long)l_ptr);
+       list_add_tail(&l_ptr->link_list, &b_ptr->links);
        tipc_k_signal((Handler)tipc_link_start, (unsigned long)l_ptr);
 
        dbg("tipc_link_create(): tolerance = %u,cont intv = %u, abort_limit = 
%u\n",
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to