[AF_IUCV]: broken send_skb_q results in endless loop

[linux-2.6-omap-h63xx.git] / net / iucv / af_iucv.c

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index aef6645803559c0e0695574a731dad158fa8a091..b3f5f840d067129a78b3ded428607e85c6dc2e18 100644 (file)
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -94,13 +94,6 @@ static void iucv_sock_clear_timer(struct sock *sk)
        sk_stop_timer(sk, &sk->sk_timer);
 }
 
-static void iucv_sock_init_timer(struct sock *sk)
-{
-       init_timer(&sk->sk_timer);
-       sk->sk_timer.function = iucv_sock_timeout;
-       sk->sk_timer.data = (unsigned long)sk;
-}
-
 static struct sock *__iucv_get_sock_by_name(char *nm)
 {
        struct sock *sk;
@@ -238,7 +231,7 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
        sk->sk_protocol = proto;
        sk->sk_state    = IUCV_OPEN;
 
-       iucv_sock_init_timer(sk);
+       setup_timer(&sk->sk_timer, iucv_sock_timeout, (unsigned long)sk);
 
        iucv_sock_link(&iucv_sk_list, sk);
        return sk;
@@ -489,6 +482,10 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
        /* Create path. */
        iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
                                     IPRMDATA, GFP_KERNEL);
+       if (!iucv->path) {
+               err = -ENOMEM;
+               goto done;
+       }
        err = iucv_path_connect(iucv->path, &af_iucv_handler,
                                sa->siucv_user_id, NULL, user_data, sk);
        if (err) {
@@ -1101,6 +1098,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
 
 save_message:
        save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
+       if (!save_msg)
+               return;
        save_msg->path = path;
        save_msg->msg = *msg;
 
@@ -1125,10 +1124,10 @@ static void iucv_callback_txdone(struct iucv_path *path,
                        this = list_skb;
                        list_skb = list_skb->next;
                } while (memcmp(&msg->tag, this->cb, 4) && list_skb);
+               __skb_unlink(this, list);
 
                spin_unlock_irqrestore(&list->lock, flags);
 
-               skb_unlink(this, &iucv_sk(sk)->send_skb_q);
                kfree_skb(this);
        }