[AF_IUCV]: defensive programming of iucv_callback_txdone

The loop in iucv_callback_txdone presumes existence of an entry
with msg->tag in the send_skb_q list. In error cases this
assumption might be wrong and might cause an endless loop.
Loop is rewritten to guarantee loop end in case of missing
msg->tag entry in send_skb_q.

Signed-off-by: Ursula Braun <braunu@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 14 insertions, 7 deletions

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index b3f5f840d067..fee22caf1bad 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1112,24 +1112,31 @@ static void iucv_callback_txdone(struct iucv_path *path,
                                  struct iucv_message *msg)
 {
         struct sock *sk = path->private;
-        struct sk_buff *this;
+        struct sk_buff *this = NULL;
         struct sk_buff_head *list = &iucv_sk(sk)->send_skb_q;
         struct sk_buff *list_skb = list->next;
         unsigned long flags;
 
-        if (list_skb) {
+        if (!skb_queue_empty(list)) {
                 spin_lock_irqsave(&list->lock, flags);
 
-                do {
-                        this = list_skb;
+                while (list_skb != (struct sk_buff *)list) {
+                        if (!memcmp(&msg->tag, list_skb->cb, 4)) {
+                                this = list_skb;
+                                break;
+                        }
                         list_skb = list_skb->next;
-                } while (memcmp(&msg->tag, this->cb, 4) && list_skb);
-                __skb_unlink(this, list);
+                }
+                if (this)
+                        __skb_unlink(this, list);
 
                 spin_unlock_irqrestore(&list->lock, flags);
 
-                kfree_skb(this);
+                if (this)
+                        kfree_skb(this);
         }
+        if (!this)
+                printk(KERN_ERR "AF_IUCV msg tag %u not found\n", msg->tag);
 
         if (sk->sk_state == IUCV_CLOSING) {
                 if (skb_queue_empty(&iucv_sk(sk)->send_skb_q)) {