caif: Fix for a race in socket transmit with flow control.

Kill faulty checks on flow-off leading to connection drop at race conditions.
caif_socket checks for flow-on before transmitting and goes to sleep or
return -EAGAIN upon flow stop. Remove faulty subsequent checks on flow-off
leading to connection drop. Also fix memory leaks on some of the errors paths.

Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/caif/cfdbgl.c b/net/caif/cfdbgl.c
index 65d6ef3cf9aab24d4df6af935f61a014d356e85f..2914659eb9b2aa96e011b43a515306334bab43de 100644 (file)
--- a/net/caif/cfdbgl.c
+++ b/net/caif/cfdbgl.c
@@ -41,8 +41,10 @@ static int cfdbgl_transmit(struct cflayer *layr, struct cfpkt *pkt)
        struct caif_payload_info *info;
        int ret;
 
-       if (!cfsrvl_ready(service, &ret))
+       if (!cfsrvl_ready(service, &ret)) {
+               cfpkt_destroy(pkt);
                return ret;
+       }
 
        /* Add info for MUX-layer to route the packet out */
        info = cfpkt_info(pkt);

diff --git a/net/caif/cfdgml.c b/net/caif/cfdgml.c
index 0f5ff27aa41ca133550d5bb3ed7ec160d6c2a586..a63f4a5f5aff6e89f4b37365d05556bc6bd99e01 100644 (file)
--- a/net/caif/cfdgml.c
+++ b/net/caif/cfdgml.c
@@ -86,12 +86,17 @@ static int cfdgml_transmit(struct cflayer *layr, struct cfpkt *pkt)
        struct caif_payload_info *info;
        struct cfsrvl *service = container_obj(layr);
        int ret;
-       if (!cfsrvl_ready(service, &ret))
+
+       if (!cfsrvl_ready(service, &ret)) {
+               cfpkt_destroy(pkt);
                return ret;
+       }
 
        /* STE Modem cannot handle more than 1500 bytes datagrams */
-       if (cfpkt_getlen(pkt) > DGM_MTU)
+       if (cfpkt_getlen(pkt) > DGM_MTU) {
+               cfpkt_destroy(pkt);
                return -EMSGSIZE;
+       }
 
        cfpkt_add_head(pkt, &zero, 3);
        packet_type = 0x08; /* B9 set - UNCLASSIFIED */

diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index 6dc75d4f8d942a183123b8720fdfe42c1e42888d..2b563ad04597de1b049e8d52c4944d9ed48b5da3 100644 (file)
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -184,6 +184,11 @@ out:
                                        rfml->serv.dev_info.id);
        }
        spin_unlock(&rfml->sync);
+
+       if (unlikely(err == -EAGAIN))
+               /* It is not possible to recover after drop of a fragment */
+               err = -EIO;
+
        return err;
 }
 
@@ -218,7 +223,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
        caif_assert(layr->dn->transmit != NULL);
 
        if (!cfsrvl_ready(&rfml->serv, &err))
-               return err;
+               goto out;
 
        err = -EPROTO;
        if (cfpkt_getlen(pkt) <= RFM_HEAD_SIZE-1)
@@ -251,8 +256,11 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 
                err = cfrfml_transmit_segment(rfml, frontpkt);
 
-               if (err != 0)
+               if (err != 0) {
+                       frontpkt = NULL;
                        goto out;
+               }
+
                frontpkt = rearpkt;
                rearpkt = NULL;
 
@@ -286,19 +294,8 @@ out:
                if (rearpkt)
                        cfpkt_destroy(rearpkt);
 
-               if (frontpkt && frontpkt != pkt) {
-
+               if (frontpkt)
                        cfpkt_destroy(frontpkt);
-                       /*
-                        * Socket layer will free the original packet,
-                        * but this packet may already be sent and
-                        * freed. So we have to return 0 in this case
-                        * to avoid socket layer to re-free this packet.
-                        * The return of shutdown indication will
-                        * cause connection to be invalidated anyhow.
-                        */
-                       err = 0;
-               }
        }
 
        return err;

diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index b99f5b22689dd333f4f83a7d68dba39e798a5789..4aa33d4496b681af783b1da932ee7e3c565b2ed6 100644 (file)
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -174,15 +174,11 @@ void cfsrvl_init(struct cfsrvl *service,
 
 bool cfsrvl_ready(struct cfsrvl *service, int *err)
 {
-       if (service->open && service->modem_flow_on && service->phy_flow_on)
-               return true;
        if (!service->open) {
                *err = -ENOTCONN;
                return false;
        }
-       caif_assert(!(service->modem_flow_on && service->phy_flow_on));
-       *err = -EAGAIN;
-       return false;
+       return true;
 }
 
 u8 cfsrvl_getphyid(struct cflayer *layer)

diff --git a/net/caif/cfutill.c b/net/caif/cfutill.c
index 53e49f3e3af3c5078fab927b461d8e1427fd975d..86d2dadb4b737d9c8ec2fae9f5d677e084ccd748 100644 (file)
--- a/net/caif/cfutill.c
+++ b/net/caif/cfutill.c
@@ -84,8 +84,11 @@ static int cfutill_transmit(struct cflayer *layr, struct cfpkt *pkt)
        caif_assert(layr != NULL);
        caif_assert(layr->dn != NULL);
        caif_assert(layr->dn->transmit != NULL);
-       if (!cfsrvl_ready(service, &ret))
+
+       if (!cfsrvl_ready(service, &ret)) {
+               cfpkt_destroy(pkt);
                return ret;
+       }
 
        cfpkt_add_head(pkt, &zero, 1);
        /* Add info for MUX-layer to route the packet out. */

diff --git a/net/caif/cfvidl.c b/net/caif/cfvidl.c
index e3f37db40ac39df501abc1e717d7e06a9a932b64..a8e2a2d758a5a773ff64dfa72a76bf9ef83bb503 100644 (file)
--- a/net/caif/cfvidl.c
+++ b/net/caif/cfvidl.c
@@ -50,8 +50,12 @@ static int cfvidl_transmit(struct cflayer *layr, struct cfpkt *pkt)
        struct caif_payload_info *info;
        u32 videoheader = 0;
        int ret;
-       if (!cfsrvl_ready(service, &ret))
+
+       if (!cfsrvl_ready(service, &ret)) {
+               cfpkt_destroy(pkt);
                return ret;
+       }
+
        cfpkt_add_head(pkt, &videoheader, 4);
        /* Add info for MUX-layer to route the packet out */
        info = cfpkt_info(pkt);