diff options
| author |   Ying Xue <ying.xue@windriver.com> | 2014-10-20 14:44:25 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-10-21 15:28:15 -0400 |
| commit | 7b8613e0a1502b43b3b36c93c66f835c891f63b3 (patch) | |
| tree | a2152fd6e1094c6716855e1ae5a4299f1c95a203 /net/tipc/socket.c | |
| parent | Merge branch 'enic' (diff) | |
| download | linux-dev-7b8613e0a1502b43b3b36c93c66f835c891f63b3.tar.xz linux-dev-7b8613e0a1502b43b3b36c93c66f835c891f63b3.zip | |
tipc: fix a potential deadlock
Locking dependency detected below possible unsafe locking scenario:
CPU0 CPU1
T0: tipc_named_rcv() tipc_rcv()
T1: [grab nametble write lock]* [grab node lock]*
T2: tipc_update_nametbl() tipc_node_link_up()
T3: tipc_nodesub_subscribe() tipc_nametbl_publish()
T4: [grab node lock]* [grab nametble write lock]*
The opposite order of holding nametbl write lock and node lock on
above two different paths may result in a deadlock. If we move the
the updating of the name table after link state named out of node
lock, the reverse order of holding locks will be eliminated, and
as a result, the deadlock risk.
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | net/tipc/socket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 75275c5cf929..3043f10dc328 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -2673,7 +2673,7 @@ static int tipc_ioctl(struct socket *sk, unsigned int cmd, unsigned long arg) case SIOCGETLINKNAME: if (copy_from_user(&lnr, argp, sizeof(lnr))) return -EFAULT; - if (!tipc_node_get_linkname(lnr.bearer_id, lnr.peer, + if (!tipc_node_get_linkname(lnr.bearer_id & 0xffff, lnr.peer, lnr.linkname, TIPC_MAX_LINK_NAME)) { if (copy_to_user(argp, &lnr, sizeof(lnr))) return -EFAULT; |