Messages in this thread | | | Date | Sat, 11 Apr 2020 20:28:13 +0200 | From | Pavel Machek <> | Subject | Re: [PATCH 4.19 03/54] sctp: fix refcount bug in sctp_wfree |
| |
Hi!
> The following case cause the bug: > for the trouble SKB, it was in outq->transmitted list
Ok... but this is one hell of "interesting" code.
> --- a/net/sctp/socket.c > +++ b/net/sctp/socket.c > @@ -165,29 +165,44 @@ static void sctp_clear_owner_w(struct sc > skb_orphan(chunk->skb); > } > > +#define traverse_and_process() \ > +do { \ > + msg = chunk->msg; \ > + if (msg == prev_msg) \ > + continue; \ > + list_for_each_entry(c, &msg->chunks, frag_list) { \ > + if ((clear && asoc->base.sk == c->skb->sk) || \ > + (!clear && asoc->base.sk != c->skb->sk)) \ > + cb(c); \ > + } \ > + prev_msg = msg; \ > +} while (0)
Should this be function?
Do you see how it does "continue"? But the do {} while(0) wrapper eats the continue. "break" would be more clear here, but they are really equivalent due to way this macro is used.
It is just very, very confusing.
Best regards, Pavel
-- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [unhandled content-type:application/pgp-signature] | |