1 files changed, 81 insertions, 51 deletions

diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index f9ff73a8d815..e6cb386fbf34 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -92,25 +92,42 @@ static void tipc_subscrp_send_event(struct tipc_subscription *sub,
  *
  * Returns 1 if there is overlap, otherwise 0.
  */
-int tipc_subscrp_check_overlap(struct tipc_subscription *sub, u32 found_lower,
+int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
                                u32 found_upper)
 {
-        if (found_lower < sub->seq.lower)
-                found_lower = sub->seq.lower;
-        if (found_upper > sub->seq.upper)
-                found_upper = sub->seq.upper;
+        if (found_lower < seq->lower)
+                found_lower = seq->lower;
+        if (found_upper > seq->upper)
+                found_upper = seq->upper;
         if (found_lower > found_upper)
                 return 0;
         return 1;
 }
 
+u32 tipc_subscrp_convert_seq_type(u32 type, int swap)
+{
+        return htohl(type, swap);
+}
+
+void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
+                              struct tipc_name_seq *out)
+{
+        out->type = htohl(in->type, swap);
+        out->lower = htohl(in->lower, swap);
+        out->upper = htohl(in->upper, swap);
+}
+
 void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
                                  u32 found_upper, u32 event, u32 port_ref,
                                  u32 node, int must)
 {
-        if (!tipc_subscrp_check_overlap(sub, found_lower, found_upper))
+        struct tipc_name_seq seq;
+
+        tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
+        if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
                 return;
-        if (!must && !(sub->filter & TIPC_SUB_PORTS))
+        if (!must &&
+            !(htohl(sub->evt.s.filter, sub->swap) & TIPC_SUB_PORTS))
                 return;
 
         tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
@@ -171,12 +188,14 @@ static struct tipc_subscriber *tipc_subscrb_create(int conid)
 static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
 {
         struct tipc_subscription *sub, *temp;
+        u32 timeout;
 
         spin_lock_bh(&subscriber->lock);
         /* Destroy any existing subscriptions for subscriber */
         list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
                                  subscrp_list) {
-                if (del_timer(&sub->timer)) {
+                timeout = htohl(sub->evt.s.timeout, sub->swap);
+                if ((timeout == TIPC_WAIT_FOREVER) || del_timer(&sub->timer)) {
                         tipc_subscrp_delete(sub);
                         tipc_subscrb_put(subscriber);
                 }
@@ -200,13 +219,16 @@ static void tipc_subscrp_cancel(struct tipc_subscr *s,
                                 struct tipc_subscriber *subscriber)
 {
         struct tipc_subscription *sub, *temp;
+        u32 timeout;
 
         spin_lock_bh(&subscriber->lock);
         /* Find first matching subscription, exit if not found */
         list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
                                  subscrp_list) {
                 if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
-                        if (del_timer(&sub->timer)) {
+                        timeout = htohl(sub->evt.s.timeout, sub->swap);
+                        if ((timeout == TIPC_WAIT_FOREVER) ||
+                            del_timer(&sub->timer)) {
                                 tipc_subscrp_delete(sub);
                                 tipc_subscrb_put(subscriber);
                         }
@@ -216,66 +238,67 @@ static void tipc_subscrp_cancel(struct tipc_subscr *s,
         spin_unlock_bh(&subscriber->lock);
 }
 
-static int tipc_subscrp_create(struct net *net, struct tipc_subscr *s,
-                               struct tipc_subscriber *subscriber,
-                               struct tipc_subscription **sub_p)
+static struct tipc_subscription *tipc_subscrp_create(struct net *net,
+                                                     struct tipc_subscr *s,
+                                                     int swap)
 {
         struct tipc_net *tn = net_generic(net, tipc_net_id);
         struct tipc_subscription *sub;
-        int swap;
-
-        /* Determine subscriber's endianness */
-        swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE));
-
-        /* Detect & process a subscription cancellation request */
-        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
-                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
-                tipc_subscrp_cancel(s, subscriber);
-                return 0;
-        }
+        u32 filter = htohl(s->filter, swap);
 
         /* Refuse subscription if global limit exceeded */
         if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                 pr_warn("Subscription rejected, limit reached (%u)\n",
                         TIPC_MAX_SUBSCRIPTIONS);
-                return -EINVAL;
+                return NULL;
         }
 
         /* Allocate subscription object */
         sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
         if (!sub) {
                 pr_warn("Subscription rejected, no memory\n");
-                return -ENOMEM;
+                return NULL;
         }
 
         /* Initialize subscription object */
         sub->net = net;
-        sub->seq.type = htohl(s->seq.type, swap);
-        sub->seq.lower = htohl(s->seq.lower, swap);
-        sub->seq.upper = htohl(s->seq.upper, swap);
-        sub->timeout = msecs_to_jiffies(htohl(s->timeout, swap));
-        sub->filter = htohl(s->filter, swap);
-        if ((!(sub->filter & TIPC_SUB_PORTS) ==
-             !(sub->filter & TIPC_SUB_SERVICE)) ||
-            (sub->seq.lower > sub->seq.upper)) {
+        if (((filter & TIPC_SUB_PORTS) && (filter & TIPC_SUB_SERVICE)) ||
+            (htohl(s->seq.lower, swap) > htohl(s->seq.upper, swap))) {
                 pr_warn("Subscription rejected, illegal request\n");
                 kfree(sub);
-                return -EINVAL;
+                return NULL;
         }
-        spin_lock_bh(&subscriber->lock);
-        list_add(&sub->subscrp_list, &subscriber->subscrp_list);
-        spin_unlock_bh(&subscriber->lock);
-        sub->subscriber = subscriber;
+
         sub->swap = swap;
         memcpy(&sub->evt.s, s, sizeof(*s));
         atomic_inc(&tn->subscription_count);
+        return sub;
+}
+
+static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
+                                   struct tipc_subscriber *subscriber, int swap)
+{
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
+        struct tipc_subscription *sub = NULL;
+        u32 timeout;
+
+        sub = tipc_subscrp_create(net, s, swap);
+        if (!sub)
+                return tipc_conn_terminate(tn->topsrv, subscriber->conid);
+
+        spin_lock_bh(&subscriber->lock);
+        list_add(&sub->subscrp_list, &subscriber->subscrp_list);
+        tipc_subscrb_get(subscriber);
+        sub->subscriber = subscriber;
+        tipc_nametbl_subscribe(sub);
+        spin_unlock_bh(&subscriber->lock);
+
+        timeout = htohl(sub->evt.s.timeout, swap);
+        if (timeout == TIPC_WAIT_FOREVER)
+                return;
+
         setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
-        if (sub->timeout != TIPC_WAIT_FOREVER)
-                sub->timeout += jiffies;
-        if (!mod_timer(&sub->timer, sub->timeout))
-                tipc_subscrb_get(subscriber);
-        *sub_p = sub;
-        return 0;
+        mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
 }
 
 /* Handle one termination request for the subscriber */
@@ -289,15 +312,22 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid,
                                 struct sockaddr_tipc *addr, void *usr_data,
                                 void *buf, size_t len)
 {
-        struct tipc_subscriber *subscrb = usr_data;
-        struct tipc_subscription *sub = NULL;
-        struct tipc_net *tn = net_generic(net, tipc_net_id);
+        struct tipc_subscriber *subscriber = usr_data;
+        struct tipc_subscr *s = (struct tipc_subscr *)buf;
+        int swap;
 
-        if (tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscrb, &sub))
-                return tipc_conn_terminate(tn->topsrv, subscrb->conid);
+        /* Determine subscriber's endianness */
+        swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE |
+                              TIPC_SUB_CANCEL));
+
+        /* Detect & process a subscription cancellation request */
+        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
+                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
+                return tipc_subscrp_cancel(s, subscriber);
+        }
 
-        if (sub)
-                tipc_nametbl_subscribe(sub);
+        if (s)
+                tipc_subscrp_subscribe(net, s, subscriber, swap);
 }
 
 /* Handle one request to establish a new subscriber */