ipcpd: Fix some bad locking

3 files changed, 43 insertions, 48 deletions

diff --git a/src/ipcpd/local/main.c b/src/ipcpd/local/main.c
index 38a901c0..718c8d7e 100644
--- a/src/ipcpd/local/main.c
+++ b/src/ipcpd/local/main.c
@@ -229,6 +229,12 @@ static int ipcp_local_flow_alloc(int       fd,
 
         assert(dst_name);
 
+        out_fd = ipcp_flow_req_arr(getpid(), dst_name, cube);
+        if (out_fd < 0) {
+                log_dbg("Flow allocation failed.");
+                return -1;
+        }
+
         pthread_rwlock_rdlock(&ipcpi.state_lock);
 
         if (ipcp_get_state() != IPCP_OPERATIONAL) {
@@ -239,14 +245,6 @@ static int ipcp_local_flow_alloc(int       fd,
 
         pthread_rwlock_wrlock(&local_data.lock);
 
-        out_fd = ipcp_flow_req_arr(getpid(), dst_name, cube);
-        if (out_fd < 0) {
-                log_dbg("Flow allocation failed.");
-                pthread_rwlock_unlock(&local_data.lock);
-                pthread_rwlock_unlock(&ipcpi.state_lock);
-                return -1;
-        }
-
         local_data.in_out[fd]  = out_fd;
         local_data.in_out[out_fd] = fd;
 
diff --git a/src/ipcpd/shim-eth-llc/main.c b/src/ipcpd/shim-eth-llc/main.c
index 8015d64a..d9f2d49f 100644
--- a/src/ipcpd/shim-eth-llc/main.c
+++ b/src/ipcpd/shim-eth-llc/main.c
@@ -374,18 +374,16 @@ static int eth_llc_ipcp_sap_req(uint8_t   r_sap,
 {
         int fd;
 
-        pthread_rwlock_rdlock(&ipcpi.state_lock);
-        pthread_rwlock_wrlock(&eth_llc_data.flows_lock);
-
         /* reply to IRM */
         fd = ipcp_flow_req_arr(getpid(), dst_name, cube);
         if (fd < 0) {
-                pthread_rwlock_unlock(&eth_llc_data.flows_lock);
-                pthread_rwlock_unlock(&ipcpi.state_lock);
                 log_err("Could not get new flow from IRMd.");
                 return -1;
         }
 
+        pthread_rwlock_rdlock(&ipcpi.state_lock);
+        pthread_rwlock_wrlock(&eth_llc_data.flows_lock);
+
         eth_llc_data.fd_to_ef[fd].r_sap = r_sap;
         memcpy(eth_llc_data.fd_to_ef[fd].r_addr, r_addr, MAC_SIZE);
 
@@ -677,19 +675,20 @@ static void * eth_llc_ipcp_sdu_writer(void * o)
         while (flow_event_wait(eth_llc_data.np1_flows,
                                eth_llc_data.fq,
                                &timeout)) {
-                pthread_rwlock_rdlock(&ipcpi.state_lock);
-
-                if (ipcp_get_state() != IPCP_OPERATIONAL) {
-                        pthread_rwlock_unlock(&ipcpi.state_lock);
-                        return (void *) -1; /* -ENOTENROLLED */
-                }
-
                 while ((fd = fqueue_next(eth_llc_data.fq)) >= 0) {
                         if (ipcp_flow_read(fd, &sdb)) {
                                 log_err("Bad read from fd %d.", fd);
                                 continue;
                         }
 
+                        pthread_rwlock_rdlock(&ipcpi.state_lock);
+
+                        if (ipcp_get_state() != IPCP_OPERATIONAL) {
+                                pthread_rwlock_unlock(&ipcpi.state_lock);
+                                ipcp_flow_del(sdb);
+                                return (void *) -1; /* -ENOTENROLLED */
+                        }
+
                         pthread_rwlock_rdlock(&eth_llc_data.flows_lock);
 
                         ssap = reverse_bits(eth_llc_data.fd_to_ef[fd].sap);
@@ -699,6 +698,7 @@ static void * eth_llc_ipcp_sdu_writer(void * o)
                                MAC_SIZE);
 
                         pthread_rwlock_unlock(&eth_llc_data.flows_lock);
+                        pthread_rwlock_unlock(&ipcpi.state_lock);
 
                         eth_llc_ipcp_send_frame(r_addr, dsap, ssap,
                                                 shm_du_buff_head(sdb),
@@ -706,8 +706,6 @@ static void * eth_llc_ipcp_sdu_writer(void * o)
                                                 - shm_du_buff_head(sdb));
                         ipcp_flow_del(sdb);
                 }
-
-                pthread_rwlock_unlock(&ipcpi.state_lock);
         }
 
         return (void *) 1;
@@ -1121,11 +1119,11 @@ static int eth_llc_ipcp_flow_dealloc(int fd)
 
         eth_llc_data.ef_to_fd[sap] = -1;
 
-        flow_dealloc(fd);
-
         pthread_rwlock_unlock(&eth_llc_data.flows_lock);
         pthread_rwlock_unlock(&ipcpi.state_lock);
 
+        flow_dealloc(fd);
+
         log_dbg("Flow with fd %d deallocated.", fd);
 
         return 0;
diff --git a/src/ipcpd/shim-udp/main.c b/src/ipcpd/shim-udp/main.c
index 3bbce79d..71f1270b 100644
--- a/src/ipcpd/shim-udp/main.c
+++ b/src/ipcpd/shim-udp/main.c
@@ -269,19 +269,17 @@ static int ipcp_udp_port_req(struct sockaddr_in * c_saddr,
                 return -1;
         }
 
-        pthread_rwlock_rdlock(&ipcpi.state_lock);
-        pthread_rwlock_wrlock(&udp_data.flows_lock);
-
         /* reply to IRM */
         fd = ipcp_flow_req_arr(getpid(), dst_name, cube);
         if (fd < 0) {
-                pthread_rwlock_unlock(&udp_data.flows_lock);
-                pthread_rwlock_unlock(&ipcpi.state_lock);
                 log_err("Could not get new flow from IRMd.");
                 close(skfd);
                 return -1;
         }
 
+        pthread_rwlock_rdlock(&ipcpi.state_lock);
+        pthread_rwlock_wrlock(&udp_data.flows_lock);
+
         udp_data.uf_to_fd[skfd]    = fd;
         udp_data.fd_to_uf[fd].skfd = skfd;
         udp_data.fd_to_uf[fd].udp  = f_saddr.sin_port;
@@ -464,10 +462,11 @@ static void * ipcp_udp_sdu_reader(void * o)
                         pthread_rwlock_rdlock(&udp_data.flows_lock);
 
                         fd = udp_data.uf_to_fd[skfd];
-                        flow_write(fd, buf, n);
 
                         pthread_rwlock_unlock(&udp_data.flows_lock);
                         pthread_rwlock_unlock(&ipcpi.state_lock);
+
+                        flow_write(fd, buf, n);
                 }
         }
 
@@ -483,34 +482,34 @@ static void * ipcp_udp_sdu_loop(void * o)
         (void) o;
 
         while (flow_event_wait(udp_data.np1_flows, udp_data.fq, &timeout)) {
-                pthread_rwlock_rdlock(&ipcpi.state_lock);
-
-                if (ipcp_get_state() != IPCP_OPERATIONAL) {
-                        pthread_rwlock_unlock(&ipcpi.state_lock);
-                        return (void *) -1; /* -ENOTENROLLED */
-                }
-
-
-                pthread_rwlock_rdlock(&udp_data.flows_lock);
-
                 while ((fd = fqueue_next(udp_data.fq)) >= 0) {
                         if (ipcp_flow_read(fd, &sdb)) {
                                 log_err("Bad read from fd %d.", fd);
                                 continue;
                         }
 
-                        if (send(udp_data.fd_to_uf[fd].skfd,
-                                 shm_du_buff_head(sdb),
+                        pthread_rwlock_rdlock(&ipcpi.state_lock);
+
+                        if (ipcp_get_state() != IPCP_OPERATIONAL) {
+                                pthread_rwlock_unlock(&ipcpi.state_lock);
+                                ipcp_flow_del(sdb);
+                                return (void *) -1; /* -ENOTENROLLED */
+                        }
+
+                        pthread_rwlock_rdlock(&udp_data.flows_lock);
+
+                        fd = udp_data.fd_to_uf[fd].skfd;
+
+                        pthread_rwlock_unlock(&udp_data.flows_lock);
+                        pthread_rwlock_unlock(&ipcpi.state_lock);
+
+                        if (send(fd, shm_du_buff_head(sdb),
                                  shm_du_buff_tail(sdb) - shm_du_buff_head(sdb),
                                  0) < 0)
                                 log_err("Failed to send SDU.");
 
                         ipcp_flow_del(sdb);
                 }
-
-
-                pthread_rwlock_unlock(&udp_data.flows_lock);
-                pthread_rwlock_unlock(&ipcpi.state_lock);
         }
 
         return (void *) 1;
@@ -1143,11 +1142,11 @@ static int ipcp_udp_flow_dealloc(int fd)
 
         clr_fd(skfd);
 
-        flow_dealloc(fd);
-
         pthread_rwlock_unlock(&udp_data.flows_lock);
         pthread_rwlock_unlock(&ipcpi.state_lock);
 
+        flow_dealloc(fd);
+
         log_dbg("Flow with fd %d deallocated.", fd);
 
         return 0;