FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2025-02-22 13:22:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[AF_IUCV]: defensive programming of iucv_callback_txdone

Browse Source 
The loop in iucv_callback_txdone presumes existence of an entry
with msg->tag in the send_skb_q list. In error cases this
assumption might be wrong and might cause an endless loop.
Loop is rewritten to guarantee loop end in case of missing
msg->tag entry in send_skb_q.

Signed-off-by: Ursula Braun <braunu@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ursula Braun 2008-02-07 18:07:44 -08:00 committed by David S. Miller
parent d44447229e
commit f2a77991a9
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
net/iucv/af_iucv.c
View File

@ -1112,24 +1112,31 @@ static void iucv_callback_txdone(struct iucv_path *path,
struct iucv_message *msg) struct iucv_message *msg)
{ {
struct sock *sk = path->private; struct sock *sk = path->private;
struct sk_buff *this; struct sk_buff *this = NULL;
struct sk_buff_head *list = &iucv_sk(sk)->send_skb_q; struct sk_buff_head *list = &iucv_sk(sk)->send_skb_q;
struct sk_buff *list_skb = list->next; struct sk_buff *list_skb = list->next;
unsigned long flags; unsigned long flags;
if (list_skb) { if (!skb_queue_empty(list)) {
spin_lock_irqsave(&list->lock, flags); spin_lock_irqsave(&list->lock, flags);
do { while (list_skb != (struct sk_buff *)list) {
this = list_skb; if (!memcmp(&msg->tag, list_skb->cb, 4)) {
this = list_skb;
break;
}
list_skb = list_skb->next; list_skb = list_skb->next;
} while (memcmp(&msg->tag, this->cb, 4) && list_skb); }
__skb_unlink(this, list); if (this)
__skb_unlink(this, list);
spin_unlock_irqrestore(&list->lock, flags); spin_unlock_irqrestore(&list->lock, flags);
kfree_skb(this); if (this)
kfree_skb(this);
} }
if (!this)
printk(KERN_ERR "AF_IUCV msg tag %u not found\n", msg->tag);
if (sk->sk_state == IUCV_CLOSING) { if (sk->sk_state == IUCV_CLOSING) {
if (skb_queue_empty(&iucv_sk(sk)->send_skb_q)) { if (skb_queue_empty(&iucv_sk(sk)->send_skb_q)) {