[AF_IUCV]: broken send_skb_q results in endless loop

A race has been detected in iucv_callback_txdone().
skb_unlink has to be done inside the locked area.

In addition checkings for successful allocations are inserted.

Signed-off-by: Ursula Braun <braunu@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 7 insertions, 1 deletions

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 2255e3c082ed..b3f5f840d067 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -482,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
         /* Create path. */
         iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
                                      IPRMDATA, GFP_KERNEL);
+        if (!iucv->path) {
+                err = -ENOMEM;
+                goto done;
+        }
         err = iucv_path_connect(iucv->path, &af_iucv_handler,
                                 sa->siucv_user_id, NULL, user_data, sk);
         if (err) {
@@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
 
 save_message:
         save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
+        if (!save_msg)
+                return;
         save_msg->path = path;
         save_msg->msg = *msg;
 
@@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path,
                         this = list_skb;
                         list_skb = list_skb->next;
                 } while (memcmp(&msg->tag, this->cb, 4) && list_skb);
+                __skb_unlink(this, list);
 
                 spin_unlock_irqrestore(&list->lock, flags);
 
-                skb_unlink(this, &iucv_sk(sk)->send_skb_q);
                 kfree_skb(this);
         }