linux/net/tipc
Jon Paul Maloy 164167794c tipc: fix bug in broadcast retransmit code
In commit 58dc55f256 ("tipc: use generic
SKB list APIs to manage link transmission queue") we replace all list
traversal loops with the macros skb_queue_walk() or
skb_queue_walk_safe(). While the previous loops were based on the
assumption that the list was NULL-terminated, the standard macros
stop when the iterator reaches the list head, which is non-NULL.

In the function bclink_retransmit_pkt() this macro replacement has
lead to a bug. When we receive a BCAST STATE_MSG we unconditionally
call the function bclink_retransmit_pkt(), whether there really is
anything to retransmit or not, assuming that the sequence number
comparisons will lead to the correct behavior. However, if the
transmission queue is empty, or if there are no eligible buffers in
the transmission queue, we will by mistake pass the list head pointer
to the function tipc_link_retransmit(). Since the list head is not a
valid sk_buff, this leads to a crash.

In this commit we fix this by only calling tipc_link_retransmit()
if we actually found eligible buffers in the transmission queue.

Reviewed-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-12 16:01:59 -05:00
..
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: explicitly include core.h in addr.h 2014-02-13 17:49:13 -05:00
bcast.c tipc: fix bug in broadcast retransmit code 2015-01-12 16:01:59 -05:00
bcast.h tipc: use generic SKB list APIs to manage TIPC outgoing packet chains 2014-11-26 12:30:17 -05:00
bearer.c tipc: fix sparse warnings in new nl api 2014-11-24 16:10:23 -05:00
bearer.h tipc: use generic SKB list APIs to manage link receive queue 2014-11-26 12:30:17 -05:00
config.c tipc: use registry when scanning sockets 2014-08-23 11:18:34 -07:00
config.h tipc: obsolete the remote management feature 2014-03-27 13:08:36 -04:00
core.c tipc: remove files ref.h and ref.c 2014-08-23 11:18:35 -07:00
core.h tipc: eliminate two pseudo message types of BUNDLE_OPEN and BUNDLE_CLOSED 2014-11-26 12:30:17 -05:00
discover.c tipc: clean up neigbor discovery message reception 2014-05-14 15:19:48 -04:00
discover.h tipc: fix race in disc create/delete 2014-04-22 21:17:53 -04:00
eth_media.c tipc: improve and extend media address conversion functions 2014-05-14 15:19:48 -04:00
ib_media.c tipc: improve and extend media address conversion functions 2014-05-14 15:19:48 -04:00
Kconfig tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
link.c tipc: fix broadcast wakeup contention after congestion 2014-12-10 14:45:33 -05:00
link.h tipc: use generic SKB list APIs to manage TIPC outgoing packet chains 2014-11-26 12:30:17 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
Makefile tipc: remove node subscription infrastructure 2014-11-26 12:30:16 -05:00
msg.c put iov_iter into msghdr 2014-12-09 16:29:03 -05:00
msg.h tipc: use generic SKB list APIs to manage TIPC outgoing packet chains 2014-11-26 12:30:17 -05:00
name_distr.c tipc: convert name table read-write lock to RCU 2014-12-08 20:39:57 -05:00
name_distr.h tipc: remove node subscription infrastructure 2014-11-26 12:30:16 -05:00
name_table.c tipc: avoid double lock 'spin_lock:&seq->lock' 2014-12-09 18:27:03 -05:00
name_table.h tipc: convert name table read-write lock to RCU 2014-12-08 20:39:57 -05:00
net.c tipc: add net set to new netlink api 2014-11-21 15:01:31 -05:00
net.h tipc: add net set to new netlink api 2014-11-21 15:01:31 -05:00
netlink.c tipc: add name table dump to new netlink api 2014-11-21 15:01:32 -05:00
netlink.h tipc: add publication dump to new netlink api 2014-11-21 15:01:30 -05:00
node.c tipc: fix broadcast wakeup contention after congestion 2014-12-10 14:45:33 -05:00
node.h tipc: use generic SKB list APIs to manage deferred queue of link 2014-11-26 12:30:17 -05:00
server.c net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
server.h tipc: remove all enabled flags from all tipc components 2014-02-22 00:00:15 -05:00
socket.c tipc: drop tx side permission checks 2014-12-09 13:30:13 -05:00
socket.h tipc: add publication dump to new netlink api 2014-11-21 15:01:30 -05:00
subscr.c tipc: remove unnecessary INIT_LIST_HEAD 2014-12-08 20:39:57 -05:00
subscr.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
sysctl.c tipc: add name distributor resiliency queue 2014-09-01 17:51:48 -07:00