tipc: fix node reference count bug
authorJon Paul Maloy <jon.maloy@ericsson.com>
Wed, 2 Dec 2015 20:19:37 +0000 (15:19 -0500)
committerDavid S. Miller <davem@davemloft.net>
Thu, 3 Dec 2015 20:19:40 +0000 (15:19 -0500)
Commit 5405ff6e15f40f2f ("tipc: convert node lock to rwlock")
introduced a bug to the node reference counter handling. When a
message is successfully sent in the function tipc_node_xmit(),
we return directly after releasing the node lock, instead of
continuing and decrementing the node reference counter as we
should do.

This commit fixes this bug.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/node.c

index 3f7a4ed..fa97d96 100644 (file)
@@ -1189,20 +1189,19 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
                        spin_unlock_bh(&le->lock);
                }
                tipc_node_read_unlock(n);
                        spin_unlock_bh(&le->lock);
                }
                tipc_node_read_unlock(n);
-               if (likely(!skb_queue_empty(&xmitq))) {
+               if (likely(!rc))
                        tipc_bearer_xmit(net, bearer_id, &xmitq, &le->maddr);
                        tipc_bearer_xmit(net, bearer_id, &xmitq, &le->maddr);
-                       return 0;
-               }
-               if (unlikely(rc == -ENOBUFS))
+               else if (rc == -ENOBUFS)
                        tipc_node_link_down(n, bearer_id, false);
                tipc_node_put(n);
                return rc;
        }
 
                        tipc_node_link_down(n, bearer_id, false);
                tipc_node_put(n);
                return rc;
        }
 
-       if (unlikely(!in_own_node(net, dnode)))
-               return rc;
-       tipc_sk_rcv(net, list);
-       return 0;
+       if (likely(in_own_node(net, dnode))) {
+               tipc_sk_rcv(net, list);
+               return 0;
+       }
+       return rc;
 }
 
 /* tipc_node_xmit_skb(): send single buffer to destination
 }
 
 /* tipc_node_xmit_skb(): send single buffer to destination