tipc: Check for disabled bearer when processing incoming messages (b02b69c8) · Commits · 戴 / test

Add a check to tipc_recv_msg() to ensure it discards messages arriving on a newly disabled bearer. This is needed to deal with a race condition that can arise if the bearer is in the midst of being disabled when it receives a message. Performing the check after tipc_net_lock has been taken ensures that TIPC's bearers are in a stable state while the message is being processed. Signed-off-by:

Allan Stephens <allan.stephens@windriver.com> Signed-off-by:

Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tipc/link.c

+14 −0

Original line number	Diff line number	Diff line
		@@ -1802,6 +1802,15 @@ static int link_recv_buf_validate(struct sk_buff *buf)
		return pskb_may_pull(buf, hdr_size);
		}

		/**
		* tipc_recv_msg - process TIPC messages arriving from off-node
		* @head: pointer to message buffer chain
		* @tb_ptr: pointer to bearer message arrived on
		*
		* Invoked with no locks held. Bearer pointer must point to a valid bearer
		* structure (i.e. cannot be NULL), but bearer can be inactive.
		*/

		void tipc_recv_msg(struct sk_buff head, struct tipc_bearer tb_ptr)
		{
		read_lock_bh(&tipc_net_lock);
		@@ -1819,6 +1828,11 @@ void tipc_recv_msg(struct sk_buff head, struct tipc_bearer tb_ptr)

		head = head->next;

		/* Ensure bearer is still enabled */

		if (unlikely(!b_ptr->active))
		goto cont;

		/* Ensure message is well-formed */

		if (unlikely(!link_recv_buf_validate(buf)))

Admin message