• J
    tipc: eliminate risk of premature link setup during failover · 17b20630
    Jon Paul Maloy 提交于
    When a link goes down, and there is still a working link towards its
    destination node, a failover is initiated, and the failed link is not
    allowed to re-establish until that procedure is finished. To ensure
    this, the concerned link endpoints are set to state LINK_FAILINGOVER,
    and the node endpoints to NODE_FAILINGOVER during the failover period.
    
    However, if the link reset is due to a disabled bearer, the corres-
    ponding link endpoint is deleted, and only the node endpoint knows
    about the ongoing failover. Now, if the disabled bearer is re-enabled
    during the failover period, the discovery mechanism may create a new
    link endpoint that is ready to be established, despite that this is not
    permitted. This situation may cause both the ongoing failover and any
    subsequent link synchronization to fail.
    
    In this commit, we ensure that a newly created link goes directly to
    state LINK_FAILINGOVER if the corresponding node state is
    NODE_FAILINGOVER. This eliminates the problem described above.
    
    Furthermore, we tighten the criteria for which packets are allowed
    to end a failover state in the function tipc_node_check_state().
    By checking that the receiving link is up and running, instead of just
    checking that it is not in failover mode, we eliminate the risk that
    protocol packets from the re-created link may cause the failover to
    be prematurely terminated.
    Reviewed-by: NYing Xue <ying.xue@windriver.com>
    Signed-off-by: NJon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    17b20630
node.c 34.0 KB