[patch 0/5] [RESEND] af_iucv patches for 2.6.30-rc1

[patch 0/5] [RESEND] af_iucv patches for 2.6.30-rc1

[Ursula Braun]

Dave,

as suggested, here is the series of critical af_iucv bug fixes.
I will submit the remaining af_iucv patches to net-next-2.6.
The patches are based on top of the current net-2.6 kernel
(2.6.30-rc1).

Hendrik Brueckner (11):
    af_iucv: fix oops in iucv_sock_recvmsg() for MSG_PEEK flag
    af_iucv: Reject incoming msgs if RECV_SHUTDOWN is set
    af_iucv: Test additional sk states in iucv_sock_shutdown
    af_iucv: Fix race when queuing incoming iucv messages

Ursula Braun (2):
    af_iucv: consider state IUCV_CLOSING when closing a socket

Kind regards,
Ursula Braun

[patch 1/5] [PATCH] af_iucv: consider state IUCV_CLOSING when closing a socket

[Ursula Braun]

[-- Attachment #1: 602-af_iucv-closing.diff --]
[-- Type: text/plain, Size: 1027 bytes --]

From: Ursula Braun <ursula.braun@de.ibm.com>

Make sure a second invocation of iucv_sock_close() guarantees proper
freeing of an iucv path.

Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
---

 net/iucv/af_iucv.c |    3 +++
 1 file changed, 3 insertions(+)

Index: net-2.6-uschi/net/iucv/af_iucv.c
===================================================================
--- net-2.6-uschi.orig/net/iucv/af_iucv.c
+++ net-2.6-uschi/net/iucv/af_iucv.c
@@ -172,6 +172,7 @@ static void iucv_sock_close(struct sock 
 			err = iucv_sock_wait_state(sk, IUCV_CLOSED, 0, timeo);
 		}
 
+	case IUCV_CLOSING:   /* fall through */
 		sk->sk_state = IUCV_CLOSED;
 		sk->sk_state_change(sk);
 
@@ -224,6 +225,8 @@ static struct sock *iucv_sock_alloc(stru
 	spin_lock_init(&iucv_sk(sk)->message_q.lock);
 	skb_queue_head_init(&iucv_sk(sk)->backlog_skb_q);
 	iucv_sk(sk)->send_tag = 0;
+	iucv_sk(sk)->path = NULL;
+	memset(&iucv_sk(sk)->src_user_id , 0, 32);
 
 	sk->sk_destruct = iucv_sock_destruct;
 	sk->sk_sndtimeo = IUCV_CONN_TIMEOUT;

[patch 2/5] [PATCH] af_iucv: fix oops in iucv_sock_recvmsg() for MSG_PEEK flag

[Ursula Braun]

[-- Attachment #1: 603-af_iucv-oops.diff --]
[-- Type: text/plain, Size: 1317 bytes --]

From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>

If iucv_sock_recvmsg() is called with MSG_PEEK flag set, the skb is enqueued
twice. If the socket is then closed, the pointer to the skb is freed twice.

Remove the skb_queue_head() call for MSG_PEEK, because the skb_recv_datagram()
function already handles MSG_PEEK (does not dequeue the skb).

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
---

 net/iucv/af_iucv.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Index: net-2.6-uschi/net/iucv/af_iucv.c
===================================================================
--- net-2.6-uschi.orig/net/iucv/af_iucv.c
+++ net-2.6-uschi/net/iucv/af_iucv.c
@@ -814,6 +814,8 @@ static int iucv_sock_recvmsg(struct kioc
 
 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
 
+	/* receive/dequeue next skb:
+	 * the function understands MSG_PEEK and, thus, does not dequeue skb */
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb) {
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -861,9 +863,7 @@ static int iucv_sock_recvmsg(struct kioc
 				iucv_process_message_q(sk);
 			spin_unlock_bh(&iucv->message_q.lock);
 		}
-
-	} else
-		skb_queue_head(&sk->sk_receive_queue, skb);
+	}
 
 done:
 	return err ? : copied;

[patch 3/5] [PATCH] af_iucv: Reject incoming msgs if RECV_SHUTDOWN is set

[Ursula Braun]

[-- Attachment #1: 604-af_iucv-rej-msgs.diff --]
[-- Type: text/plain, Size: 973 bytes --]

From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>

Reject incoming iucv messages if the receive direction has been shut down.
It avoids that the queue of outstanding messages increases and exceeds the
message limit of the iucv communication path.

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
---

 net/iucv/af_iucv.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Index: net-2.6-uschi/net/iucv/af_iucv.c
===================================================================
--- net-2.6-uschi.orig/net/iucv/af_iucv.c
+++ net-2.6-uschi/net/iucv/af_iucv.c
@@ -1116,8 +1116,10 @@ static void iucv_callback_rx(struct iucv
 	struct sock_msg_q *save_msg;
 	int len;
 
-	if (sk->sk_shutdown & RCV_SHUTDOWN)
+	if (sk->sk_shutdown & RCV_SHUTDOWN) {
+		iucv_message_reject(path, msg);
 		return;
+	}
 
 	if (!list_empty(&iucv->message_q.list) ||
 	    !skb_queue_empty(&iucv->backlog_skb_q))

[patch 4/5] [PATCH] af_iucv: Test additional sk states in iucv_sock_shutdown

[Ursula Braun]

[-- Attachment #1: 606-af_iucv-sk-states.diff --]
[-- Type: text/plain, Size: 704 bytes --]

From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>

Add few more sk states in iucv_sock_shutdown().

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
---

 net/iucv/af_iucv.c |    3 +++
 1 file changed, 3 insertions(+)

Index: net-2.6-uschi/net/iucv/af_iucv.c
===================================================================
--- net-2.6-uschi.orig/net/iucv/af_iucv.c
+++ net-2.6-uschi/net/iucv/af_iucv.c
@@ -937,6 +937,9 @@ static int iucv_sock_shutdown(struct soc
 
 	lock_sock(sk);
 	switch (sk->sk_state) {
+	case IUCV_DISCONN:
+	case IUCV_CLOSING:
+	case IUCV_SEVERED:
 	case IUCV_CLOSED:
 		err = -ENOTCONN;
 		goto fail;

[patch 5/5] [PATCH] af_iucv: Fix race when queuing incoming iucv messages

[Ursula Braun]

[-- Attachment #1: 613-af_iucv-incoming-race.diff --]
[-- Type: text/plain, Size: 1694 bytes --]

From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>

AF_IUCV runs into a race when queuing incoming iucv messages
and receiving the resulting backlog.

If the Linux system is under pressure (high load or steal time),
the message queue grows up, but messages are not received and queued
onto the backlog queue. In that case, applications do not
receive any data with recvmsg() even if AF_IUCV puts incoming
messages onto the message queue.

The race can be avoided if the message queue spinlock in the
message_pending callback is spreaded across the entire callback
function.

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
---

 net/iucv/af_iucv.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Index: net-2.6-uschi/net/iucv/af_iucv.c
===================================================================
--- net-2.6-uschi.orig/net/iucv/af_iucv.c
+++ net-2.6-uschi/net/iucv/af_iucv.c
@@ -1124,6 +1124,8 @@ static void iucv_callback_rx(struct iucv
 		return;
 	}
 
+	spin_lock(&iucv->message_q.lock);
+
 	if (!list_empty(&iucv->message_q.list) ||
 	    !skb_queue_empty(&iucv->backlog_skb_q))
 		goto save_message;
@@ -1137,9 +1139,8 @@ static void iucv_callback_rx(struct iucv
 	if (!skb)
 		goto save_message;
 
-	spin_lock(&iucv->message_q.lock);
 	iucv_process_message(sk, skb, path, msg);
-	spin_unlock(&iucv->message_q.lock);
+	goto out_unlock;
 
 	return;
 
@@ -1150,8 +1151,9 @@ save_message:
 	save_msg->path = path;
 	save_msg->msg = *msg;
 
-	spin_lock(&iucv->message_q.lock);
 	list_add_tail(&save_msg->list, &iucv->message_q.list);
+
+out_unlock:
 	spin_unlock(&iucv->message_q.lock);
 }
 

Re: [patch 0/5] [RESEND] af_iucv patches for 2.6.30-rc1

[David Miller]

From: Ursula Braun <ursula.braun@de.ibm.com>
Date: Tue, 21 Apr 2009 18:04:19 +0200

> as suggested, here is the series of critical af_iucv bug fixes.
> I will submit the remaining af_iucv patches to net-next-2.6.
> The patches are based on top of the current net-2.6 kernel
> (2.6.30-rc1).
> 
> Hendrik Brueckner (11):
>     af_iucv: fix oops in iucv_sock_recvmsg() for MSG_PEEK flag
>     af_iucv: Reject incoming msgs if RECV_SHUTDOWN is set
>     af_iucv: Test additional sk states in iucv_sock_shutdown
>     af_iucv: Fix race when queuing incoming iucv messages
> 
> Ursula Braun (2):
>     af_iucv: consider state IUCV_CLOSING when closing a socket

All applied, thanks.