summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJon Maloy <jon.maloy@ericsson.com>2017-12-18 18:13:34 +0100
committerDavid S. Miller <davem@davemloft.net>2017-12-18 13:16:40 -0500
commit3f42f5fe31c8715a34064bfd7b788488d1ea2f7c (patch)
treebb6f596e37ae0cd2f972a9ef3b710d46a441b4c2 /net
parent234833991e14681f61cbfd93e65a5c976089cf11 (diff)
downloadlinux-3f42f5fe31c8715a34064bfd7b788488d1ea2f7c.tar.bz2
tipc: remove leaving group member from all lists
A group member going into state LEAVING should never go back to any other state before it is finally deleted. However, this might happen if the socket needs to send out a RECLAIM message during this interval. Since we forget to remove the leaving member from the group's 'active' or 'pending' list, the member might be selected for reclaiming, change state to RECLAIMING, and get stuck in this state instead of being deleted. This might lead to suppression of the expected 'member down' event to the receiver. We fix this by removing the member from all lists, except the RB tree, at the moment it goes into state LEAVING. Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/tipc/group.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/tipc/group.c b/net/tipc/group.c
index efb5714e7a85..b96ec429bb9b 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -699,6 +699,9 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
if (!m)
return;
m->bc_syncpt = msg_grp_bc_syncpt(hdr);
+ list_del_init(&m->list);
+ list_del_init(&m->congested);
+ *usr_wakeup = true;
/* Wait until WITHDRAW event is received */
if (m->state != MBR_LEAVING) {
@@ -710,8 +713,6 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
ehdr = buf_msg(m->event_msg);
msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
__skb_queue_tail(inputq, m->event_msg);
- *usr_wakeup = true;
- list_del_init(&m->congested);
return;
case GRP_ADV_MSG:
if (!m)
@@ -863,6 +864,7 @@ void tipc_group_member_evt(struct tipc_group *grp,
msg_set_grp_bc_seqno(hdr, m->bc_rcv_nxt);
__skb_queue_tail(inputq, skb);
}
+ list_del_init(&m->list);
list_del_init(&m->congested);
}
*sk_rcvbuf = tipc_group_rcvbuf_limit(grp);