From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jon Maloy Subject: [net-next 1/1] tipc: make link capability update thread safe Date: Wed, 18 Jul 2018 19:50:06 +0200 Message-ID: <1531936206-3118-1-git-send-email-jon.maloy@ericsson.com> Mime-Version: 1.0 Content-Type: text/plain Cc: , , , , , , To: , Return-path: Received: from sesbmg22.ericsson.net ([193.180.251.48]:51735 "EHLO sesbmg22.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731193AbeGRS3Q (ORCPT ); Wed, 18 Jul 2018 14:29:16 -0400 Sender: netdev-owner@vger.kernel.org List-ID: The commit referred to below introduced an update of the link capabilities field that is not safe. Given the recently added feature to remove idle node and link items after 5 minutes, there is a small risk that the update will happen at the very moment the targeted link is being removed. To avoid this we have to perform the update inside the node item's write lock protection. Fixes: 9012de508956 ("tipc: add sequence number check for link STATE messages") Signed-off-by: Jon Maloy --- net/tipc/node.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 52fd80b..3819ab1 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -370,13 +370,17 @@ static struct tipc_node *tipc_node_create(struct net *net, u32 addr, spin_lock_bh(&tn->node_list_lock); n = tipc_node_find(net, addr); if (n) { + if (n->capabilities == capabilities) + goto exit; /* Same node may come back with new capabilities */ + write_lock_bh(&n->lock); n->capabilities = capabilities; for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) { l = n->links[bearer_id].link; if (l) tipc_link_update_caps(l, capabilities); } + write_unlock_bh(&n->lock); goto exit; } n = kzalloc(sizeof(*n), GFP_ATOMIC); -- 2.1.4