> net/tipc/node.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > >diff --git a/net/tipc/node.c b/net/tipc/node.c index >3105abe97bb9..2a036b8a7da3 100644 >--- a/net/tipc/node.c >+++ b/net/tipc/node.c >@@ -2154,14 +2154,15 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, >struct tipc_bearer *b) > /* Receive packet directly if conditions permit */ > tipc_node_read_lock(n); > if (likely((n->state == SELF_UP_PEER_UP) && (usr != TUNNEL_PROTOCOL))) { >+ tipc_node_read_unlock(n); > spin_lock_bh(&le->lock); > if (le->link) { > rc = tipc_link_rcv(le->link, skb, &xmitq); > skb = NULL; > } > spin_unlock_bh(&le->lock); >- } >- tipc_node_read_unlock(n); >+ } else >+ tipc_node_read_unlock(n); > > /* Check/update node state before receiving */ > if (unlikely(skb)) { >@@ -2169,12 +2170,13 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, >struct tipc_bearer *b) > goto out_node_put; > tipc_node_write_lock(n); > if (tipc_node_check_state(n, skb, bearer_id, &xmitq)) { >+ tipc_node_write_unlock(n); > if (le->link) { > rc = tipc_link_rcv(le->link, skb, &xmitq); > skb = NULL; > } >- } >- tipc_node_write_unlock(n); >+ } else >+ tipc_node_write_unlock(n); > } > > if (unlikely(rc & TIPC_LINK_UP_EVT)) >-- >2.15.2 > > This patch is wrong. le->link and link status must be protected by node lock. See what happens if tipc_node_timeout() is called, and the link goes down: tipc_node_timeout() tipc_node_link_down() { struct tipc_link *l = le->link; ... if (delete) { kfree(l); le->link = NULL; } ... }
_______________________________________________ tipc-discussion mailing list tipc-discussion@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tipc-discussion