l2tp: Fix locking in l2tp_ip.c
Both l2tp_ip_connect() and l2tp_ip_sendmsg() must take the socket lock. They both modify socket state non-atomically, and in particular l2tp_ip_sendmsg() increments socket private counters without using atomic operations. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
da905bd1d5
commit
2f16270f41
|
@ -311,6 +311,8 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
|
||||||
if (lsa->l2tp_family != AF_INET)
|
if (lsa->l2tp_family != AF_INET)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
|
lock_sock(sk);
|
||||||
|
|
||||||
sk_dst_reset(sk);
|
sk_dst_reset(sk);
|
||||||
|
|
||||||
oif = sk->sk_bound_dev_if;
|
oif = sk->sk_bound_dev_if;
|
||||||
|
@ -356,6 +358,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
|
||||||
|
|
||||||
rc = 0;
|
rc = 0;
|
||||||
out:
|
out:
|
||||||
|
release_sock(sk);
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -420,18 +423,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
|
||||||
int connected = 0;
|
int connected = 0;
|
||||||
__be32 daddr;
|
__be32 daddr;
|
||||||
|
|
||||||
|
lock_sock(sk);
|
||||||
|
|
||||||
|
rc = -ENOTCONN;
|
||||||
if (sock_flag(sk, SOCK_DEAD))
|
if (sock_flag(sk, SOCK_DEAD))
|
||||||
return -ENOTCONN;
|
goto out;
|
||||||
|
|
||||||
/* Get and verify the address. */
|
/* Get and verify the address. */
|
||||||
if (msg->msg_name) {
|
if (msg->msg_name) {
|
||||||
struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name;
|
struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name;
|
||||||
|
rc = -EINVAL;
|
||||||
if (msg->msg_namelen < sizeof(*lip))
|
if (msg->msg_namelen < sizeof(*lip))
|
||||||
return -EINVAL;
|
goto out;
|
||||||
|
|
||||||
if (lip->l2tp_family != AF_INET) {
|
if (lip->l2tp_family != AF_INET) {
|
||||||
|
rc = -EAFNOSUPPORT;
|
||||||
if (lip->l2tp_family != AF_UNSPEC)
|
if (lip->l2tp_family != AF_UNSPEC)
|
||||||
return -EAFNOSUPPORT;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
daddr = lip->l2tp_addr.s_addr;
|
daddr = lip->l2tp_addr.s_addr;
|
||||||
|
@ -510,12 +518,15 @@ error:
|
||||||
lsa->tx_errors++;
|
lsa->tx_errors++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
out:
|
||||||
|
release_sock(sk);
|
||||||
return rc;
|
return rc;
|
||||||
|
|
||||||
no_route:
|
no_route:
|
||||||
IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
|
IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
|
||||||
kfree_skb(skb);
|
kfree_skb(skb);
|
||||||
return -EHOSTUNREACH;
|
rc = -EHOSTUNREACH;
|
||||||
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
|
static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
|
||||||
|
|
Loading…
Reference in a new issue