caif: Fix freezes when running CAIF loopback device

Fix spinlock bugs when running out of link-ids in loopback tests and
avoid allocating link-id when error is set in link-setup-response.

Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index f8ac31371a4a9f4bc9e62579e645f8a0fcdee706..e22671bed66917a8899a1a0e5ab4c8ff7291c99b 100644 (file)
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -368,7 +368,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
        cfpkt_extr_head(pkt, &cmdrsp, 1);
        cmd = cmdrsp & CFCTRL_CMD_MASK;
        if (cmd != CFCTRL_CMD_LINK_ERR
-           && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp)) {
+           && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp)
+               && CFCTRL_ERR_BIT != (CFCTRL_ERR_BIT & cmdrsp)) {
                if (handle_loop(cfctrl, cmd, pkt) != 0)
                        cmdrsp |= CFCTRL_ERR_BIT;
        }
@@ -604,16 +605,16 @@ static int handle_loop(struct cfctrl *ctrl, int cmd, struct cfpkt *pkt)
        case CFCTRL_CMD_LINK_SETUP:
                spin_lock_bh(&ctrl->loop_linkid_lock);
                if (!dec) {
-                       for (linkid = last_linkid + 1; linkid < 255; linkid++)
+                       for (linkid = last_linkid + 1; linkid < 254; linkid++)
                                if (!ctrl->loop_linkused[linkid])
                                        goto found;
                }
                dec = 1;
-               for (linkid = last_linkid - 1; linkid > 0; linkid--)
+               for (linkid = last_linkid - 1; linkid > 1; linkid--)
                        if (!ctrl->loop_linkused[linkid])
                                goto found;
                spin_unlock_bh(&ctrl->loop_linkid_lock);
-
+               return -1;
 found:
                if (linkid < 10)
                        dec = 0;