[net 1/1] tipc: remove leaving group member from all lists

[net 1/1] tipc: remove leaving group member from all lists

[Jon Maloy]

A group member going into state LEAVING should never go back to any
other state before it is finally deleted. However, this might happen
if the socket needs to send out a RECLAIM message during this interval.
Since we forget to remove the leaving member from the group's 'active'
or 'pending' list, the member might be selected for reclaiming, change
state to RECLAIMING, and get stuck in this state instead of being
deleted. This might lead to suppression of the expected 'member down'
event to the receiver.

We fix this by removing the member from all lists, except the RB tree,
at the moment it goes into state LEAVING.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
---
 net/tipc/group.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/tipc/group.c b/net/tipc/group.c
index efb5714..b96ec42 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -699,6 +699,9 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
 		if (!m)
 			return;
 		m->bc_syncpt = msg_grp_bc_syncpt(hdr);
+		list_del_init(&m->list);
+		list_del_init(&m->congested);
+		*usr_wakeup = true;
 
 		/* Wait until WITHDRAW event is received */
 		if (m->state != MBR_LEAVING) {
@@ -710,8 +713,6 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
 		ehdr = buf_msg(m->event_msg);
 		msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
 		__skb_queue_tail(inputq, m->event_msg);
-		*usr_wakeup = true;
-		list_del_init(&m->congested);
 		return;
 	case GRP_ADV_MSG:
 		if (!m)
@@ -863,6 +864,7 @@ void tipc_group_member_evt(struct tipc_group *grp,
 				msg_set_grp_bc_seqno(hdr, m->bc_rcv_nxt);
 			__skb_queue_tail(inputq, skb);
 		}
+		list_del_init(&m->list);
 		list_del_init(&m->congested);
 	}
 	*sk_rcvbuf = tipc_group_rcvbuf_limit(grp);
-- 
2.1.4

Re: [net 1/1] tipc: remove leaving group member from all lists

[David Miller]

From: Jon Maloy <jon.maloy@ericsson.com>
Date: Mon, 18 Dec 2017 18:13:34 +0100

> A group member going into state LEAVING should never go back to any
> other state before it is finally deleted. However, this might happen
> if the socket needs to send out a RECLAIM message during this interval.
> Since we forget to remove the leaving member from the group's 'active'
> or 'pending' list, the member might be selected for reclaiming, change
> state to RECLAIMING, and get stuck in this state instead of being
> deleted. This might lead to suppression of the expected 'member down'
> event to the receiver.
> 
> We fix this by removing the member from all lists, except the RB tree,
> at the moment it goes into state LEAVING.
> 
> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>

Also applied, thanks Jon.