[PATCH 1/1] DCCP Ackvec: fix soft lockup in ackvec handling code

[PATCH 1/1] DCCP Ackvec: fix soft lockup in ackvec handling code

[Andrea Bittau]

A soft lockup existed in the handling of ack vector records.  Specifically, when
a tail of the list of ack vector records was removed, it was possible to end up
iterating infinitely on an element of the tail.

Signed-off-by: Andrea Bittau <a.bittau@cs.ucl.ac.uk>

---

diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index 2349078..a856d72 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -453,6 +453,7 @@ #endif
 					      (unsigned long long)
 					      avr->dccpavr_ack_ackno);
 				dccp_ackvec_throw_record(av, avr);
+				break;
 			}
 			/*
 			 * If it wasn't received, continue scanning... we might

Re: [PATCH 1/1] DCCP Ackvec: fix soft lockup in ackvec handling code

[Ian McDonald]

[-- Attachment #1: Type: text/plain, Size: 2098 bytes --]

Dave,

I have tested this and wonder whether it can be pushed upstream for
Linus for 2.6.17 if at all possible. I know Arnaldo is the maintainer
but as you are aware he is very busy with other projects at present.

This fix makes CCID2 usable - previously it was unusable for most
users. I had about five users report it as broken to me and this fixes
it for me. I am able to make it crash reproducibly without it and it
doesn't with the patch.

I've also put inline and attached (as gmail mailer mangles sometimes)
the patch redone against Linus' tree as Andrea's patch didn't apply
cleanly for me.

Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>

Thanks,

Ian
-- 
Ian McDonald
Web: http://wand.net.nz/~iam4
Blog: http://imcdnzl.blogspot.com
WAND Network Research Group
Department of Computer Science
University of Waikato
New Zealand

diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index b5981e5..8c211c5 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -452,6 +452,7 @@ #endif
 					      (unsigned long long)
 					      avr->dccpavr_ack_ackno);
 				dccp_ackvec_throw_record(av, avr);
+				break;
 			}
 			/*
 			 * If it wasn't received, continue scanning... we might


On 6/10/06, Andrea Bittau <a.bittau@cs.ucl.ac.uk> wrote:
> A soft lockup existed in the handling of ack vector records.  Specifically, when
> a tail of the list of ack vector records was removed, it was possible to end up
> iterating infinitely on an element of the tail.
>
> Signed-off-by: Andrea Bittau <a.bittau@cs.ucl.ac.uk>
>
> ---
>
> diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
> index 2349078..a856d72 100644
> --- a/net/dccp/ackvec.c
> +++ b/net/dccp/ackvec.c
> @@ -453,6 +453,7 @@ #endif
>                                               (unsigned long long)
>                                               avr->dccpavr_ack_ackno);
>                                 dccp_ackvec_throw_record(av, avr);
> +                               break;
>                         }
>                         /*
>                          * If it wasn't received, continue scanning... we might
> -

[-- Attachment #2: ackvecfix.diff --]
[-- Type: text/x-patch, Size: 351 bytes --]

diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index b5981e5..8c211c5 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -452,6 +452,7 @@ #endif
 					      (unsigned long long)
 					      avr->dccpavr_ack_ackno);
 				dccp_ackvec_throw_record(av, avr);
+				break;
 			}
 			/*
 			 * If it wasn't received, continue scanning... we might

Re: [PATCH 1/1] DCCP Ackvec: fix soft lockup in ackvec handling

[David Miller]

From: "Ian McDonald" <ian.mcdonald@jandi.co.nz>
Date: Sat, 10 Jun 2006 20:28:39 +1200

> I have tested this and wonder whether it can be pushed upstream for
> Linus for 2.6.17 if at all possible. I know Arnaldo is the maintainer
> but as you are aware he is very busy with other projects at present.

I'll push this upstream over the weekend, it's in my patch
log :-)

Re: [PATCH 1/1] DCCP Ackvec: fix soft lockup in ackvec handling code

[Arnaldo Carvalho de Melo]

David Miller wrote:
> From: "Ian McDonald" <ian.mcdonald@jandi.co.nz>
> Date: Sat, 10 Jun 2006 20:28:39 +1200
> 
>> I have tested this and wonder whether it can be pushed upstream for
>> Linus for 2.6.17 if at all possible. I know Arnaldo is the maintainer
>> but as you are aware he is very busy with other projects at present.
> 
> I'll push this upstream over the weekend, it's in my patch
> log :-)

Thanks everybody, real one liner, huh? :-)

- Arnaldo