lkml.org 
[lkml]   [2017]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH net v2] tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
    From
    From: Tommi Rantala <tommi.t.rantala@nokia.com>
    Date: Wed, 29 Nov 2017 12:48:42 +0200

    > Remove the second tipc_rcv() call in tipc_udp_recv(). We have just
    > checked that the bearer is not up, and calling tipc_rcv() with a bearer
    > that is not up leads to a TIPC div-by-zero crash in
    > tipc_node_calculate_timer(). The crash is rare in practice, but can
    > happen like this:
    >
    > We're enabling a bearer, but it's not yet up and fully initialized.
    > At the same time we receive a discovery packet, and in tipc_udp_recv()
    > we end up calling tipc_rcv() with the not-yet-initialized bearer,
    > causing later the div-by-zero crash in tipc_node_calculate_timer().
    >
    > Jon Maloy explains the impact of removing the second tipc_rcv() call:
    > "link setup in the worst case will be delayed until the next arriving
    > discovery messages, 1 sec later, and this is an acceptable delay."
    >
    > As the tipc_rcv() call is removed, just leave the function via the
    > rcu_out label, so that we will kfree_skb().
    ...
    > Fixes: c9b64d492b1f ("tipc: add replicast peer discovery")
    > Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
    > Cc: Jon Maloy <jon.maloy@ericsson.com>

    Applied and queued up for -stable, thanks.

    \
     
     \ /
      Last update: 2017-12-01 21:16    [W:6.180 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site