iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tipc: fix node reference count bug

Browse Source 
Commit 5405ff6e15 ("tipc: convert node lock to rwlock")
introduced a bug to the node reference counter handling. When a
message is successfully sent in the function tipc_node_xmit(),
we return directly after releasing the node lock, instead of
continuing and decrementing the node reference counter as we
should do.

This commit fixes this bug.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jon Paul Maloy 2015-12-02 15:19:37 -05:00 committed by David S. Miller
parent b69e3c6f71
commit dc8d1eb305
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/tipc/node.c
View File

@ -1189,20 +1189,19 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
spin_unlock_bh(&le->lock);
}
tipc_node_read_unlock(n);
if (likely(!skb_queue_empty(&xmitq))) {
if (likely(!rc))
tipc_bearer_xmit(net, bearer_id, &xmitq, &le->maddr);
return 0;
}
if (unlikely(rc == -ENOBUFS))
else if (rc == -ENOBUFS)
tipc_node_link_down(n, bearer_id, false);
tipc_node_put(n);
return rc;
}
if (unlikely(!in_own_node(net, dnode)))
return rc;
tipc_sk_rcv(net, list);
return 0;
if (likely(in_own_node(net, dnode))) {
tipc_sk_rcv(net, list);
return 0;
}
return rc;
}
/* tipc_node_xmit_skb(): send single buffer to destination