This is a note to let you know that I've just added the patch titled tipc: drop subscriber connection id invalidation to the 3.13-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tipc-drop-subscriber-connection-id-invalidation.patch and it can be found in the queue-3.13 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Apr 10 22:03:04 PDT 2014 From: Erik Hugne <erik.hugne@xxxxxxxxxxxx> Date: Thu, 6 Mar 2014 14:40:19 +0100 Subject: tipc: drop subscriber connection id invalidation From: Erik Hugne <erik.hugne@xxxxxxxxxxxx> [ Upstream commit edcc0511b5ee7235282a688cd604e3ae7f9e1fc9 ] When a topology server subscriber is disconnected, the associated connection id is set to zero. A check vs zero is then done in the subscription timeout function to see if the subscriber have been shut down. This is unnecessary, because all subscription timers will be cancelled when a subscriber terminates. Setting the connection id to zero is actually harmful because id zero is the identity of the topology server listening socket, and can cause a race that leads to this socket being closed instead. Signed-off-by: Erik Hugne <erik.hugne@xxxxxxxxxxxx> Acked-by: Ying Xue <ying.xue@xxxxxxxxxxxxx> Reviewed-by: Jon Maloy <jon.maloy@xxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/tipc/subscr.c | 11 ----------- 1 file changed, 11 deletions(-) --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c @@ -149,14 +149,6 @@ static void subscr_timeout(struct tipc_s /* The spin lock per subscriber is used to protect its members */ spin_lock_bh(&subscriber->lock); - /* Validate if the connection related to the subscriber is - * closed (in case subscriber is terminating) - */ - if (subscriber->conid == 0) { - spin_unlock_bh(&subscriber->lock); - return; - } - /* Validate timeout (in case subscription is being cancelled) */ if (sub->timeout == TIPC_WAIT_FOREVER) { spin_unlock_bh(&subscriber->lock); @@ -211,9 +203,6 @@ static void subscr_release(struct tipc_s spin_lock_bh(&subscriber->lock); - /* Invalidate subscriber reference */ - subscriber->conid = 0; - /* Destroy any existing subscriptions for subscriber */ list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list, subscription_list) { Patches currently in stable-queue which might be from erik.hugne@xxxxxxxxxxxx are queue-3.13/tipc-fix-connection-refcount-leak.patch queue-3.13/tipc-drop-subscriber-connection-id-invalidation.patch queue-3.13/tipc-allow-connection-shutdown-callback-to-be-invoked.patch queue-3.13/tipc-fix-spinlock-recursion-bug-for-failed-subscriptions.patch queue-3.13/tipc-fix-memory-leak-during-module-removal.patch queue-3.13/tipc-don-t-log-disabled-tasklet-handler-errors.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html