Commit c2afb605 authored by Marcel Holtmann's avatar Marcel Holtmann Committed by Adrian Bunk

[Bluetooth] Add locking for bt_proto array manipulation

The bt_proto array needs to be protected by some kind of locking to
prevent a race condition between bt_sock_create and bt_sock_register.

And in addition all calls to sk_alloc need to be made GFP_ATOMIC now.
Signed-off-by: default avatarMasatake YAMATO <jet@gyve.org>
Signed-off-by: default avatarFrederik Deweerdt <frederik.deweerdt@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
parent ac4d63da
...@@ -54,36 +54,51 @@ ...@@ -54,36 +54,51 @@
/* Bluetooth sockets */ /* Bluetooth sockets */
#define BT_MAX_PROTO 8 #define BT_MAX_PROTO 8
static struct net_proto_family *bt_proto[BT_MAX_PROTO]; static struct net_proto_family *bt_proto[BT_MAX_PROTO];
static DEFINE_RWLOCK(bt_proto_lock);
int bt_sock_register(int proto, struct net_proto_family *ops) int bt_sock_register(int proto, struct net_proto_family *ops)
{ {
int err = 0;
if (proto < 0 || proto >= BT_MAX_PROTO) if (proto < 0 || proto >= BT_MAX_PROTO)
return -EINVAL; return -EINVAL;
if (bt_proto[proto]) write_lock(&bt_proto_lock);
return -EEXIST;
if (bt_proto[proto])
err = -EEXIST;
else
bt_proto[proto] = ops; bt_proto[proto] = ops;
return 0;
write_unlock(&bt_proto_lock);
return err;
} }
EXPORT_SYMBOL(bt_sock_register); EXPORT_SYMBOL(bt_sock_register);
int bt_sock_unregister(int proto) int bt_sock_unregister(int proto)
{ {
int err = 0;
if (proto < 0 || proto >= BT_MAX_PROTO) if (proto < 0 || proto >= BT_MAX_PROTO)
return -EINVAL; return -EINVAL;
if (!bt_proto[proto]) write_lock(&bt_proto_lock);
return -ENOENT;
if (!bt_proto[proto])
err = -ENOENT;
else
bt_proto[proto] = NULL; bt_proto[proto] = NULL;
return 0;
write_unlock(&bt_proto_lock);
return err;
} }
EXPORT_SYMBOL(bt_sock_unregister); EXPORT_SYMBOL(bt_sock_unregister);
static int bt_sock_create(struct socket *sock, int proto) static int bt_sock_create(struct socket *sock, int proto)
{ {
int err = 0; int err;
if (proto < 0 || proto >= BT_MAX_PROTO) if (proto < 0 || proto >= BT_MAX_PROTO)
return -EINVAL; return -EINVAL;
...@@ -93,11 +108,18 @@ static int bt_sock_create(struct socket *sock, int proto) ...@@ -93,11 +108,18 @@ static int bt_sock_create(struct socket *sock, int proto)
request_module("bt-proto-%d", proto); request_module("bt-proto-%d", proto);
} }
#endif #endif
err = -EPROTONOSUPPORT; err = -EPROTONOSUPPORT;
read_lock(&bt_proto_lock);
if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) { if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
err = bt_proto[proto]->create(sock, proto); err = bt_proto[proto]->create(sock, proto);
module_put(bt_proto[proto]->owner); module_put(bt_proto[proto]->owner);
} }
read_unlock(&bt_proto_lock);
return err; return err;
} }
......
...@@ -215,7 +215,7 @@ static int bnep_sock_create(struct socket *sock, int protocol) ...@@ -215,7 +215,7 @@ static int bnep_sock_create(struct socket *sock, int protocol)
if (sock->type != SOCK_RAW) if (sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT; return -ESOCKTNOSUPPORT;
sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &bnep_proto, 1); sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto, 1);
if (!sk) if (!sk)
return -ENOMEM; return -ENOMEM;
......
...@@ -206,7 +206,7 @@ static int cmtp_sock_create(struct socket *sock, int protocol) ...@@ -206,7 +206,7 @@ static int cmtp_sock_create(struct socket *sock, int protocol)
if (sock->type != SOCK_RAW) if (sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT; return -ESOCKTNOSUPPORT;
sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &cmtp_proto, 1); sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &cmtp_proto, 1);
if (!sk) if (!sk)
return -ENOMEM; return -ENOMEM;
......
...@@ -622,7 +622,7 @@ static int hci_sock_create(struct socket *sock, int protocol) ...@@ -622,7 +622,7 @@ static int hci_sock_create(struct socket *sock, int protocol)
sock->ops = &hci_sock_ops; sock->ops = &hci_sock_ops;
sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1); sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
if (!sk) if (!sk)
return -ENOMEM; return -ENOMEM;
......
...@@ -257,7 +257,7 @@ static int hidp_sock_create(struct socket *sock, int protocol) ...@@ -257,7 +257,7 @@ static int hidp_sock_create(struct socket *sock, int protocol)
if (sock->type != SOCK_RAW) if (sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT; return -ESOCKTNOSUPPORT;
sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hidp_proto, 1); sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto, 1);
if (!sk) if (!sk)
return -ENOMEM; return -ENOMEM;
......
...@@ -414,7 +414,7 @@ static int l2cap_sock_create(struct socket *sock, int protocol) ...@@ -414,7 +414,7 @@ static int l2cap_sock_create(struct socket *sock, int protocol)
sock->ops = &l2cap_sock_ops; sock->ops = &l2cap_sock_ops;
sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL); sk = l2cap_sock_alloc(sock, protocol, GFP_ATOMIC);
if (!sk) if (!sk)
return -ENOMEM; return -ENOMEM;
......
...@@ -337,7 +337,8 @@ static int rfcomm_sock_create(struct socket *sock, int protocol) ...@@ -337,7 +337,8 @@ static int rfcomm_sock_create(struct socket *sock, int protocol)
sock->ops = &rfcomm_sock_ops; sock->ops = &rfcomm_sock_ops;
if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL))) sk = rfcomm_sock_alloc(sock, protocol, GFP_ATOMIC);
if (!sk)
return -ENOMEM; return -ENOMEM;
rfcomm_sock_init(sk, NULL); rfcomm_sock_init(sk, NULL);
......
...@@ -455,7 +455,8 @@ static int sco_sock_create(struct socket *sock, int protocol) ...@@ -455,7 +455,8 @@ static int sco_sock_create(struct socket *sock, int protocol)
sock->ops = &sco_sock_ops; sock->ops = &sco_sock_ops;
if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL))) sk = sco_sock_alloc(sock, protocol, GFP_ATOMIC);
if (!sk)
return -ENOMEM; return -ENOMEM;
sco_sock_init(sk, NULL); sco_sock_init(sk, NULL);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment