diff options
| author | Jon Paul Maloy <jon.maloy@ericsson.com> | 2015-12-02 15:19:37 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-12-03 15:19:40 -0500 |
| commit | dc8d1eb305984b1182f5e85de3c3a1f8592b83af (patch) | |
| tree | 612716949497835537f318a836fbd4f2490a0951 | |
| parent | b69e3c6f71a53fb46bba588e651d943785398220 (diff) | |
| download | linux-dc8d1eb305984b1182f5e85de3c3a1f8592b83af.tar.bz2 | |
tipc: fix node reference count bug
Commit 5405ff6e15f40f2f ("tipc: convert node lock to rwlock")
introduced a bug to the node reference counter handling. When a
message is successfully sent in the function tipc_node_xmit(),
we return directly after releasing the node lock, instead of
continuing and decrementing the node reference counter as we
should do.
This commit fixes this bug.
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tipc/node.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/net/tipc/node.c b/net/tipc/node.c index 3f7a4ed71990..fa97d9649a28 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -1189,20 +1189,19 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list, spin_unlock_bh(&le->lock); } tipc_node_read_unlock(n); - if (likely(!skb_queue_empty(&xmitq))) { + if (likely(!rc)) tipc_bearer_xmit(net, bearer_id, &xmitq, &le->maddr); - return 0; - } - if (unlikely(rc == -ENOBUFS)) + else if (rc == -ENOBUFS) tipc_node_link_down(n, bearer_id, false); tipc_node_put(n); return rc; } - if (unlikely(!in_own_node(net, dnode))) - return rc; - tipc_sk_rcv(net, list); - return 0; + if (likely(in_own_node(net, dnode))) { + tipc_sk_rcv(net, list); + return 0; + } + return rc; } /* tipc_node_xmit_skb(): send single buffer to destination |