tipc: fix connection abort during subscription cancel

Orabug: 23330935

[ Upstream commit 4d5cfcba2f6ec494d8810b9e3c0a7b06255c8067 ]

In 'commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing
to events")', we terminate the connection if the subscription
creation fails.
In the same commit, the subscription creation result was based on
the value of the subscription pointer (set in the function) instead
of the return code.

Unfortunately, the same function tipc_subscrp_create() handles
subscription cancel request. For a subscription cancellation request,
the subscription pointer cannot be set. Thus if a subscriber has
several subscriptions and cancels any of them, the connection is
terminated.

In this commit, we terminate the connection based on the return value
of tipc_subscrp_create().
Fixes: commit 7fe8097cef5f ("tipc: fix nullpointer bug when subscribing to events")
Reviewed-by:  Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 257a04782588b4b97ac005a044f85947f792be44)

Signed-off-by: Dan Duval <dan.duval@oracle.com>

diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 1c147c869c2e68312ee02b5275589ba0e18f7727..948f316019d7352a136131528bbe8df115749d11 100644 (file)
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -302,11 +302,10 @@ static void subscr_conn_msg_event(struct net *net, int conid,
        struct tipc_net *tn = net_generic(net, tipc_net_id);
 
        spin_lock_bh(&subscriber->lock);
-       subscr_subscribe(net, (struct tipc_subscr *)buf, subscriber, &sub);
-       if (sub)
-               tipc_nametbl_subscribe(sub);
-       else
+       if (subscr_subscribe(net, (struct tipc_subscr *)buf, subscriber, &sub))
                tipc_conn_terminate(tn->topsrv, subscriber->conid);
+       else
+               tipc_nametbl_subscribe(sub);
        spin_unlock_bh(&subscriber->lock);
 }