Commit dc8d1eb3 authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller

tipc: fix node reference count bug

Commit 5405ff6e ("tipc: convert node lock to rwlock")
introduced a bug to the node reference counter handling. When a
message is successfully sent in the function tipc_node_xmit(),
we return directly after releasing the node lock, instead of
continuing and decrementing the node reference counter as we
should do.

This commit fixes this bug.
Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b69e3c6f
......@@ -1189,20 +1189,19 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
spin_unlock_bh(&le->lock);
}
tipc_node_read_unlock(n);
if (likely(!skb_queue_empty(&xmitq))) {
if (likely(!rc))
tipc_bearer_xmit(net, bearer_id, &xmitq, &le->maddr);
return 0;
}
if (unlikely(rc == -ENOBUFS))
else if (rc == -ENOBUFS)
tipc_node_link_down(n, bearer_id, false);
tipc_node_put(n);
return rc;
}
if (unlikely(!in_own_node(net, dnode)))
return rc;
if (likely(in_own_node(net, dnode))) {
tipc_sk_rcv(net, list);
return 0;
}
return rc;
}
/* tipc_node_xmit_skb(): send single buffer to destination
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment