lkml.org 
[lkml]   [2014]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 003/110] af_iucv: wrong mapping of sent and confirmed skbs
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ursula Braun <ursula.braun@de.ibm.com>

    commit f5738e2ef88070ef1372e6e718124d88e9abe4ac upstream.

    When sending data through IUCV a MESSAGE COMPLETE interrupt
    signals that sent data memory can be freed or reused again.
    With commit f9c41a62bba3f3f7ef3541b2a025e3371bcbba97
    "af_iucv: fix recvmsg by replacing skb_pull() function" the
    MESSAGE COMPLETE callback iucv_callback_txdone() identifies
    the wrong skb as being confirmed, which leads to data corruption.
    This patch fixes the skb mapping logic in iucv_callback_txdone().

    Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
    Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/iucv/af_iucv.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/iucv/af_iucv.c
    +++ b/net/iucv/af_iucv.c
    @@ -1829,7 +1829,7 @@ static void iucv_callback_txdone(struct
    spin_lock_irqsave(&list->lock, flags);

    while (list_skb != (struct sk_buff *)list) {
    - if (msg->tag != IUCV_SKB_CB(list_skb)->tag) {
    + if (msg->tag == IUCV_SKB_CB(list_skb)->tag) {
    this = list_skb;
    break;
    }



    \
     
     \ /
      Last update: 2014-06-28 21:41    [W:4.689 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site