提交 b02b69c8 编写于 作者: A Allan Stephens 提交者: David S. Miller

tipc: Check for disabled bearer when processing incoming messages

Add a check to tipc_recv_msg() to ensure it discards messages
arriving on a newly disabled bearer.  This is needed to deal with a
race condition that can arise if the bearer is in the midst of being
disabled when it receives a message.  Performing the check after
tipc_net_lock has been taken ensures that TIPC's bearers are in a
stable state while the message is being processed.
Signed-off-by: NAllan Stephens <allan.stephens@windriver.com>
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 f662c070
...@@ -1802,6 +1802,15 @@ static int link_recv_buf_validate(struct sk_buff *buf) ...@@ -1802,6 +1802,15 @@ static int link_recv_buf_validate(struct sk_buff *buf)
return pskb_may_pull(buf, hdr_size); return pskb_may_pull(buf, hdr_size);
} }
/**
* tipc_recv_msg - process TIPC messages arriving from off-node
* @head: pointer to message buffer chain
* @tb_ptr: pointer to bearer message arrived on
*
* Invoked with no locks held. Bearer pointer must point to a valid bearer
* structure (i.e. cannot be NULL), but bearer can be inactive.
*/
void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
{ {
read_lock_bh(&tipc_net_lock); read_lock_bh(&tipc_net_lock);
...@@ -1819,6 +1828,11 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) ...@@ -1819,6 +1828,11 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
head = head->next; head = head->next;
/* Ensure bearer is still enabled */
if (unlikely(!b_ptr->active))
goto cont;
/* Ensure message is well-formed */ /* Ensure message is well-formed */
if (unlikely(!link_recv_buf_validate(buf))) if (unlikely(!link_recv_buf_validate(buf)))
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册