[NETLINK]: Fix infinite loops in synchronous netlink changes.

The qlen should continue to decrement, even if we
pop partially processed SKBs back onto the receive queue.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6e1ab1e34b2ec70630009aa4b4fd2f4ebac8a35c..75b6d33b52924787089a3dcc9971ddecb8185113 100644 (file)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -626,14 +626,13 @@ static void rtnetlink_rcv(struct sock *sk, int len)
                if (qlen > skb_queue_len(&sk->sk_receive_queue))
                        qlen = skb_queue_len(&sk->sk_receive_queue);
 
-               while (qlen--) {
+               for (; qlen; qlen--) {
                        skb = skb_dequeue(&sk->sk_receive_queue);
                        if (rtnetlink_rcv_skb(skb)) {
-                               if (skb->len) {
+                               if (skb->len)
                                        skb_queue_head(&sk->sk_receive_queue,
                                                       skb);
-                                       qlen++;
-                               } else
+                               else
                                        kfree_skb(skb);
                                break;
                        }

diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 101ddef9ba9aa2aad76b4c26cb88a98551c7dbc5..284a9998e53d756f02fe84a3cfd16ef2276cf617 100644 (file)
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -121,7 +121,7 @@ static void dnrmg_receive_user_sk(struct sock *sk, int len)
        struct sk_buff *skb;
        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
 
-       while (qlen-- && (skb = skb_dequeue(&sk->sk_receive_queue))) {
+       for (; qlen && (skb = skb_dequeue(&sk->sk_receive_queue)); qlen--) {
                dnrmg_receive_user_skb(skb);
                kfree_skb(skb);
        }

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index dab112f1dd8a8c10eec2a044eb75852e2a64335a..e8740a4a1d7845704cabda0f0f6f4891bf683761 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1018,14 +1018,13 @@ static void xfrm_netlink_rcv(struct sock *sk, int len)
                if (qlen > skb_queue_len(&sk->sk_receive_queue))
                        qlen = skb_queue_len(&sk->sk_receive_queue);
 
-               while (qlen--) {
+               for (; qlen; qlen--) {
                        skb = skb_dequeue(&sk->sk_receive_queue);
                        if (xfrm_user_rcv_skb(skb)) {
-                               if (skb->len) {
+                               if (skb->len)
                                        skb_queue_head(&sk->sk_receive_queue,
                                                       skb);
-                                       qlen++;
-                               } else
+                               else
                                        kfree_skb(skb);
                                break;
                        }