summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDavid S. Miller <davem@sunset.davemloft.net>2005-05-03 15:30:05 -0700
committerDavid S. Miller <davem@davemloft.net>2005-05-03 15:30:05 -0700
commit09e14305982efc2f3b509d3c50ef5dcbff64a998 (patch)
tree7829c8b212a84e793ebf2d5bd0ceb68283c7b79e /net
parent2a0a6ebee1d68552152ae8d4aeda91d806995dec (diff)
downloadlinux-09e14305982efc2f3b509d3c50ef5dcbff64a998.tar.gz
linux-09e14305982efc2f3b509d3c50ef5dcbff64a998.tar.bz2
linux-09e14305982efc2f3b509d3c50ef5dcbff64a998.zip
[NETLINK]: Fix infinite loops in synchronous netlink changes.
The qlen should continue to decrement, even if we pop partially processed SKBs back onto the receive queue. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/rtnetlink.c7
-rw-r--r--net/decnet/netfilter/dn_rtmsg.c2
-rw-r--r--net/xfrm/xfrm_user.c7
3 files changed, 7 insertions, 9 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6e1ab1e34b2e..75b6d33b5292 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -626,14 +626,13 @@ static void rtnetlink_rcv(struct sock *sk, int len)
if (qlen > skb_queue_len(&sk->sk_receive_queue))
qlen = skb_queue_len(&sk->sk_receive_queue);
- while (qlen--) {
+ for (; qlen; qlen--) {
skb = skb_dequeue(&sk->sk_receive_queue);
if (rtnetlink_rcv_skb(skb)) {
- if (skb->len) {
+ if (skb->len)
skb_queue_head(&sk->sk_receive_queue,
skb);
- qlen++;
- } else
+ else
kfree_skb(skb);
break;
}
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 101ddef9ba9a..284a9998e53d 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -121,7 +121,7 @@ static void dnrmg_receive_user_sk(struct sock *sk, int len)
struct sk_buff *skb;
unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
- while (qlen-- && (skb = skb_dequeue(&sk->sk_receive_queue))) {
+ for (; qlen && (skb = skb_dequeue(&sk->sk_receive_queue)); qlen--) {
dnrmg_receive_user_skb(skb);
kfree_skb(skb);
}
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index dab112f1dd8a..e8740a4a1d78 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1018,14 +1018,13 @@ static void xfrm_netlink_rcv(struct sock *sk, int len)
if (qlen > skb_queue_len(&sk->sk_receive_queue))
qlen = skb_queue_len(&sk->sk_receive_queue);
- while (qlen--) {
+ for (; qlen; qlen--) {
skb = skb_dequeue(&sk->sk_receive_queue);
if (xfrm_user_rcv_skb(skb)) {
- if (skb->len) {
+ if (skb->len)
skb_queue_head(&sk->sk_receive_queue,
skb);
- qlen++;
- } else
+ else
kfree_skb(skb);
break;
}