lkml.org 
[lkml]   [2016]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 01/98] tipc: fix connection abort during subscription cancel
    Date
    4.2.8-ckt6 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>

    [ Upstream commit 4d5cfcba2f6ec494d8810b9e3c0a7b06255c8067 ]

    In 'commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing
    to events")', we terminate the connection if the subscription
    creation fails.
    In the same commit, the subscription creation result was based on
    the value of the subscription pointer (set in the function) instead
    of the return code.

    Unfortunately, the same function tipc_subscrp_create() handles
    subscription cancel request. For a subscription cancellation request,
    the subscription pointer cannot be set. Thus if a subscriber has
    several subscriptions and cancels any of them, the connection is
    terminated.

    In this commit, we terminate the connection based on the return value
    of tipc_subscrp_create().
    Fixes: commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing to events")

    Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/tipc/subscr.c | 11 +++++------
    1 file changed, 5 insertions(+), 6 deletions(-)

    diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
    index 350cca3..69ee2ee 100644
    --- a/net/tipc/subscr.c
    +++ b/net/tipc/subscr.c
    @@ -289,15 +289,14 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid,
    struct sockaddr_tipc *addr, void *usr_data,
    void *buf, size_t len)
    {
    - struct tipc_subscriber *subscriber = usr_data;
    + struct tipc_subscriber *subscrb = usr_data;
    struct tipc_subscription *sub = NULL;
    struct tipc_net *tn = net_generic(net, tipc_net_id);

    - tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscriber, &sub);
    - if (sub)
    - tipc_nametbl_subscribe(sub);
    - else
    - tipc_conn_terminate(tn->topsrv, subscriber->conid);
    + if (tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscrb, &sub))
    + return tipc_conn_terminate(tn->topsrv, subscrb->conid);
    +
    + tipc_nametbl_subscribe(sub);
    }

    /* Handle one request to establish a new subscriber */
    --
    2.7.0
    \
     
     \ /
      Last update: 2016-03-16 01:01    [W:4.139 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site