Commit bfe9a6d7 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tipc-topology-server-fixes' 



Parthasarathy Bhuvaragan says:

====================
tipc: topology server fixes

The following commits fixes two race conditions causing general
protection faults.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4eb6a3bd fd849b7c

net/tipc/subscr.c

+9 −12
Original line number Diff line number Diff line
@@ -52,7 +52,6 @@ struct tipc_subscriber { 
	struct list_head subscrp_list;

};



static void tipc_subscrp_delete(struct tipc_subscription *sub);

static void tipc_subscrb_put(struct tipc_subscriber *subscriber);



/**
@@ -197,15 +196,19 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber, 
{

	struct list_head *subscription_list = &subscriber->subscrp_list;

	struct tipc_subscription *sub, *temp;

	u32 timeout;



	spin_lock_bh(&subscriber->lock);

	list_for_each_entry_safe(sub, temp, subscription_list,  subscrp_list) {

		if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))

			continue;



		timeout = htohl(sub->evt.s.timeout, sub->swap);

		if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) {

			tipc_nametbl_unsubscribe(sub);

			list_del(&sub->subscrp_list);

		tipc_subscrp_delete(sub);

			tipc_subscrp_put(sub);

		}



		if (s)

			break;
@@ -236,18 +239,12 @@ static void tipc_subscrb_delete(struct tipc_subscriber *subscriber) 
	tipc_subscrb_put(subscriber);

}



static void tipc_subscrp_delete(struct tipc_subscription *sub)

{

	u32 timeout = htohl(sub->evt.s.timeout, sub->swap);



	if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer))

		tipc_subscrp_put(sub);

}



static void tipc_subscrp_cancel(struct tipc_subscr *s,

				struct tipc_subscriber *subscriber)

{

	tipc_subscrb_get(subscriber);

	tipc_subscrb_subscrp_delete(subscriber, s);

	tipc_subscrb_put(subscriber);

}



static struct tipc_subscription *tipc_subscrp_create(struct net *net,