Attachment 297214 Details for Bug 436067 – debug patch

[patch] debug patch

sctp.patch (text/plain), 1.90 KB, created by Neil Horman on 2008-03-07 16:46:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Neil Horman

Created: 2008-03-07 16:46:31 UTC

Size: 1.90 KB

patch

obsolete

>--- linux-2.6.18.x86_64/include/net/sctp/structs.h.orig	2008-03-06 11:02:22.000000000 -0500
>+++ linux-2.6.18.x86_64/include/net/sctp/structs.h	2008-03-07 08:49:57.000000000 -0500
>@@ -614,7 +614,7 @@
> struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
> 					    struct sctp_sndrcvinfo *,
> 					    struct msghdr *, int len);
>-void sctp_datamsg_put(struct sctp_datamsg *);
>+int sctp_datamsg_put(struct sctp_datamsg *);
> void sctp_datamsg_free(struct sctp_datamsg *);
> void sctp_datamsg_track(struct sctp_chunk *);
> void sctp_chunk_fail(struct sctp_chunk *, int error);
>--- linux-2.6.18.x86_64/net/sctp/chunk.c.orig	2008-03-06 09:12:30.000000000 -0500
>+++ linux-2.6.18.x86_64/net/sctp/chunk.c	2008-03-07 08:57:25.000000000 -0500
>@@ -130,10 +130,14 @@
> }
> 
> /* Release a reference. */
>-void sctp_datamsg_put(struct sctp_datamsg *msg)
>+int sctp_datamsg_put(struct sctp_datamsg *msg)
> {
>-	if (atomic_dec_and_test(&msg->refcnt))
>+	int rc = 0;
>+	if (atomic_dec_and_test(&msg->refcnt)) {
>+		rc = 1;
> 		sctp_datamsg_destroy(msg);
>+	}
>+	return rc;
> }
> 
> /* Free a message.  Really just give up a reference, the
>--- linux-2.6.18.x86_64/net/sctp/sm_make_chunk.c.orig	2008-03-06 14:19:36.000000000 -0500
>+++ linux-2.6.18.x86_64/net/sctp/sm_make_chunk.c	2008-03-07 09:31:33.000000000 -0500
>@@ -1103,14 +1103,23 @@
> 
> /* Possibly, free the chunk.  */
> void sctp_chunk_free(struct sctp_chunk *chunk)
>-{
>+{	int cnt;
> 	BUG_ON(!list_empty(&chunk->list));
> 	list_del_init(&chunk->transmitted_list);
> 
> 	/* Release our reference on the message tracker. */
>-	if (chunk->msg)
>-		sctp_datamsg_put(chunk->msg);
> 
>+	/*
>+	 * We should never delete the parent datamsg here
>+	 * if the chunks refcnt is less than 2.  If it is
>+	 * then we have a bug, caused by a double chunk_free
>+	 */
>+	if (chunk->msg) {
>+		cnt = atomic_read(&chunk->refcnt);
>+		if (cnt < 2) 
>+			if (sctp_datamsg_put(chunk->msg) == 1)
>+				BUG();
>+	}
> 	sctp_chunk_put(chunk);
> }
>

Actions: View | Diff

Attachments on bug 436067: 296925 | 297049 | 297108 | 297214 | 297967