Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d44447229e35115675d166b51a52e512c281475c
Commit:     d44447229e35115675d166b51a52e512c281475c
Parent:     435bc9dfc6927eed9465e297d7aca1217aa61956
Author:     Ursula Braun <[EMAIL PROTECTED]>
AuthorDate: Thu Feb 7 18:07:19 2008 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Thu Feb 7 18:07:19 2008 -0800

    [AF_IUCV]: broken send_skb_q results in endless loop
    
    A race has been detected in iucv_callback_txdone().
    skb_unlink has to be done inside the locked area.
    
    In addition checkings for successful allocations are inserted.
    
    Signed-off-by: Ursula Braun <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/iucv/af_iucv.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 2255e3c..b3f5f84 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -482,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct 
sockaddr *addr,
        /* Create path. */
        iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
                                     IPRMDATA, GFP_KERNEL);
+       if (!iucv->path) {
+               err = -ENOMEM;
+               goto done;
+       }
        err = iucv_path_connect(iucv->path, &af_iucv_handler,
                                sa->siucv_user_id, NULL, user_data, sk);
        if (err) {
@@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, 
struct iucv_message *msg)
 
 save_message:
        save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
+       if (!save_msg)
+               return;
        save_msg->path = path;
        save_msg->msg = *msg;
 
@@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path,
                        this = list_skb;
                        list_skb = list_skb->next;
                } while (memcmp(&msg->tag, this->cb, 4) && list_skb);
+               __skb_unlink(this, list);
 
                spin_unlock_irqrestore(&list->lock, flags);
 
-               skb_unlink(this, &iucv_sk(sk)->send_skb_q);
                kfree_skb(this);
        }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to