From: Jean Tourrilhes <jt@bougret.hpl.hp.com>
Date: Thu, 21 Oct 2004 15:08:56 +0000 (-0700)
Subject: [IRDA]: IAS safety comments
X-Git-Tag: v2.6.10-rc1~13^2~27
X-Git-Url: http://git.neil.brown.name/?a=commitdiff_plain;h=dbc5a5f9f7ca342a73b0d09e21f73bd22cb8bc0f;p=history.git

[IRDA]: IAS safety comments

o [FEATURE] Make optional the del of IAS object when del IAS attrib
o [FEATURE] Clarify when/why it's safe to to the above

Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/include/net/irda/irias_object.h b/include/net/irda/irias_object.h
index 6ffaed3291c0..c41196b87955 100644
--- a/include/net/irda/irias_object.h
+++ b/include/net/irda/irias_object.h
@@ -81,7 +81,8 @@ struct ias_attrib {
 struct ias_object *irias_new_object(char *name, int id);
 void irias_insert_object(struct ias_object *obj);
 int  irias_delete_object(struct ias_object *obj);
-int  irias_delete_attrib(struct ias_object *obj, struct ias_attrib *attrib);
+int  irias_delete_attrib(struct ias_object *obj, struct ias_attrib *attrib,
+			 int cleanobject);
 void __irias_delete_object(struct ias_object *obj);
 
 void irias_add_integer_attrib(struct ias_object *obj, char *name, int value,
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index f415a4e0645e..bc6aa5db3bb5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2005,7 +2005,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 		}
 
 		/* Remove the attribute (and maybe the object) */
-		irias_delete_attrib(ias_obj, ias_attr);
+		irias_delete_attrib(ias_obj, ias_attr, 1);
 		kfree(ias_opt);
 		break;
 	case IRLMP_MAX_SDU_SIZE:
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index 058bf54dcb7e..bc8d74df1563 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -159,11 +159,14 @@ int irias_delete_object(struct ias_object *obj)
 	ASSERT(obj != NULL, return -1;);
 	ASSERT(obj->magic == IAS_OBJECT_MAGIC, return -1;);
 
+	/* Remove from list */
 	node = hashbin_remove_this(irias_objects, (irda_queue_t *) obj);
 	if (!node)
-		return 0; /* Already removed */
+		IRDA_DEBUG( 0, "%s(), object already removed!\n",
+			    __FUNCTION__);
 
-	__irias_delete_object(node);
+	/* Destroy */
+	__irias_delete_object(obj);
 
 	return 0;
 }
@@ -176,7 +179,8 @@ EXPORT_SYMBOL(irias_delete_object);
  *    the object, remove the object as well.
  *
  */
-int irias_delete_attrib(struct ias_object *obj, struct ias_attrib *attrib)
+int irias_delete_attrib(struct ias_object *obj, struct ias_attrib *attrib,
+			int cleanobject)
 {
 	struct ias_attrib *node;
 
@@ -192,9 +196,13 @@ int irias_delete_attrib(struct ias_object *obj, struct ias_attrib *attrib)
 	/* Deallocate attribute */
 	__irias_delete_attrib(node);
 
-	/* Check if object has still some attributes */
+	/* Check if object has still some attributes, destroy it if none.
+	 * At first glance, this look dangerous, as the kernel reference
+	 * various IAS objects. However, we only use this function on
+	 * user attributes, not kernel attributes, so there is no risk
+	 * of deleting a kernel object this way. Jean II */
 	node = (struct ias_attrib *) hashbin_get_first(obj->attribs);
-	if (!node)
+	if (cleanobject && !node)
 		irias_delete_object(obj);
 
 	return 0;