lkml.org 
[lkml]   [2017]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
From
From: Tommi Rantala <tommi.t.rantala@nokia.com>
Date: Tue, 28 Nov 2017 14:53:15 +0200

> Call tipc_rcv() only if bearer is up in tipc_udp_recv().
> Fixes a rare TIPC div-by-zero crash in tipc_node_calculate_timer():
>
> We're enabling a bearer, but it's not yet up and fully initialized.
> At the same time we receive a discovery packet, and in tipc_udp_recv()
> we end up calling tipc_rcv() with the not-yet-initialized bearer,
> causing later a div-by-zero crash in tipc_node_calculate_timer().

You're also now ignoring any error being returned by tipc_udp_rcast_disc().

> -
> - if (unlikely(msg_user(hdr) == LINK_CONFIG)) {
> - err = tipc_udp_rcast_disc(b, skb);
> - if (err)
> - goto rcu_out;
> + } else {
> + if (unlikely(b && msg_user(hdr) == LINK_CONFIG))
> + tipc_udp_rcast_disc(b, skb);
> + kfree_skb(skb);
> }

Either put the 'err' propagation back or clearly explain in your
commit log message why this part of the change if absolutely essential
for this bug fix.

Thank you.

\
 
 \ /
  Last update: 2017-11-28 15:59    [W:0.050 / U:0.392 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site