Commit 01462405f0c093b2f8dfddafcadcda6c9e4c5cdf

Authored by Jiri Bohac
Committed by David S. Miller
1 parent d3052bb5d3

ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg

This fixes an old regression introduced by commit
b0d0d915 (ipx: remove the BKL).

When a recvmsg syscall blocks waiting for new data, no data can be sent on the
same socket with sendmsg because ipx_recvmsg() sleeps with the socket locked.

This breaks mars-nwe (NetWare emulator):
- the ncpserv process reads the request using recvmsg
- ncpserv forks and spawns nwconn
- ncpserv calls a (blocking) recvmsg and waits for new requests
- nwconn deadlocks in sendmsg on the same socket

Commit b0d0d915 has simply replaced BKL locking with
lock_sock/release_sock. Unlike now, BKL got unlocked while
sleeping, so a blocking recvmsg did not block a concurrent
sendmsg.

Only keep the socket locked while actually working with the socket data and
release it prior to calling skb_recv_datagram().

Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 5 additions and 1 deletions Side-by-side Diff

... ... @@ -1764,6 +1764,7 @@
1764 1764 struct ipxhdr *ipx = NULL;
1765 1765 struct sk_buff *skb;
1766 1766 int copied, rc;
  1767 + bool locked = true;
1767 1768  
1768 1769 lock_sock(sk);
1769 1770 /* put the autobinding in */
... ... @@ -1790,6 +1791,8 @@
1790 1791 if (sock_flag(sk, SOCK_ZAPPED))
1791 1792 goto out;
1792 1793  
  1794 + release_sock(sk);
  1795 + locked = false;
1793 1796 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1794 1797 flags & MSG_DONTWAIT, &rc);
1795 1798 if (!skb) {
... ... @@ -1826,7 +1829,8 @@
1826 1829 out_free:
1827 1830 skb_free_datagram(sk, skb);
1828 1831 out:
1829   - release_sock(sk);
  1832 + if (locked)
  1833 + release_sock(sk);
1830 1834 return rc;
1831 1835 }
1832 1836