Commit 2f16270f authored by David S. Miller's avatar David S. Miller

l2tp: Fix locking in l2tp_ip.c

Both l2tp_ip_connect() and l2tp_ip_sendmsg() must take the socket
lock.  They both modify socket state non-atomically, and in particular
l2tp_ip_sendmsg() increments socket private counters without using
atomic operations.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent da905bd1
...@@ -311,6 +311,8 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len ...@@ -311,6 +311,8 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
if (lsa->l2tp_family != AF_INET) if (lsa->l2tp_family != AF_INET)
goto out; goto out;
lock_sock(sk);
sk_dst_reset(sk); sk_dst_reset(sk);
oif = sk->sk_bound_dev_if; oif = sk->sk_bound_dev_if;
...@@ -356,6 +358,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len ...@@ -356,6 +358,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
rc = 0; rc = 0;
out: out:
release_sock(sk);
return rc; return rc;
} }
...@@ -420,18 +423,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m ...@@ -420,18 +423,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
int connected = 0; int connected = 0;
__be32 daddr; __be32 daddr;
lock_sock(sk);
rc = -ENOTCONN;
if (sock_flag(sk, SOCK_DEAD)) if (sock_flag(sk, SOCK_DEAD))
return -ENOTCONN; goto out;
/* Get and verify the address. */ /* Get and verify the address. */
if (msg->msg_name) { if (msg->msg_name) {
struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name; struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name;
rc = -EINVAL;
if (msg->msg_namelen < sizeof(*lip)) if (msg->msg_namelen < sizeof(*lip))
return -EINVAL; goto out;
if (lip->l2tp_family != AF_INET) { if (lip->l2tp_family != AF_INET) {
rc = -EAFNOSUPPORT;
if (lip->l2tp_family != AF_UNSPEC) if (lip->l2tp_family != AF_UNSPEC)
return -EAFNOSUPPORT; goto out;
} }
daddr = lip->l2tp_addr.s_addr; daddr = lip->l2tp_addr.s_addr;
...@@ -510,12 +518,15 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m ...@@ -510,12 +518,15 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
lsa->tx_errors++; lsa->tx_errors++;
} }
out:
release_sock(sk);
return rc; return rc;
no_route: no_route:
IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES); IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
kfree_skb(skb); kfree_skb(skb);
return -EHOSTUNREACH; rc = -EHOSTUNREACH;
goto out;
} }
static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment