Commit 01462405f0c093b2f8dfddafcadcda6c9e4c5cdf
Committed by
David S. Miller
1 parent
d3052bb5d3
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
This fixes an old regression introduced by commit b0d0d915 (ipx: remove the BKL). When a recvmsg syscall blocks waiting for new data, no data can be sent on the same socket with sendmsg because ipx_recvmsg() sleeps with the socket locked. This breaks mars-nwe (NetWare emulator): - the ncpserv process reads the request using recvmsg - ncpserv forks and spawns nwconn - ncpserv calls a (blocking) recvmsg and waits for new requests - nwconn deadlocks in sendmsg on the same socket Commit b0d0d915 has simply replaced BKL locking with lock_sock/release_sock. Unlike now, BKL got unlocked while sleeping, so a blocking recvmsg did not block a concurrent sendmsg. Only keep the socket locked while actually working with the socket data and release it prior to calling skb_recv_datagram(). Signed-off-by: Jiri Bohac <jbohac@suse.cz> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 5 additions and 1 deletions Side-by-side Diff
net/ipx/af_ipx.c
... | ... | @@ -1764,6 +1764,7 @@ |
1764 | 1764 | struct ipxhdr *ipx = NULL; |
1765 | 1765 | struct sk_buff *skb; |
1766 | 1766 | int copied, rc; |
1767 | + bool locked = true; | |
1767 | 1768 | |
1768 | 1769 | lock_sock(sk); |
1769 | 1770 | /* put the autobinding in */ |
... | ... | @@ -1790,6 +1791,8 @@ |
1790 | 1791 | if (sock_flag(sk, SOCK_ZAPPED)) |
1791 | 1792 | goto out; |
1792 | 1793 | |
1794 | + release_sock(sk); | |
1795 | + locked = false; | |
1793 | 1796 | skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, |
1794 | 1797 | flags & MSG_DONTWAIT, &rc); |
1795 | 1798 | if (!skb) { |
... | ... | @@ -1826,7 +1829,8 @@ |
1826 | 1829 | out_free: |
1827 | 1830 | skb_free_datagram(sk, skb); |
1828 | 1831 | out: |
1829 | - release_sock(sk); | |
1832 | + if (locked) | |
1833 | + release_sock(sk); | |
1830 | 1834 | return rc; |
1831 | 1835 | } |
1832 | 1836 |