Commit e2e210c0 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

l2tp: fix race in l2tp_recv_dequeue()

Misha Labjuk reported panics occurring in l2tp_recv_dequeue()

If we release reorder_q.lock, we must not keep a dangling pointer (tmp),
since another thread could manipulate reorder_q.

Instead we must restart the scan at beginning of list.
Reported-by: default avatarMisha Labjuk <spiked.yar@gmail.com>
Tested-by: default avatarMisha Labjuk <spiked.yar@gmail.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2edcd4ca
...@@ -397,6 +397,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session) ...@@ -397,6 +397,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
* expect to send up next, dequeue it and any other * expect to send up next, dequeue it and any other
* in-sequence packets behind it. * in-sequence packets behind it.
*/ */
start:
spin_lock_bh(&session->reorder_q.lock); spin_lock_bh(&session->reorder_q.lock);
skb_queue_walk_safe(&session->reorder_q, skb, tmp) { skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) { if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
...@@ -433,7 +434,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session) ...@@ -433,7 +434,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
*/ */
spin_unlock_bh(&session->reorder_q.lock); spin_unlock_bh(&session->reorder_q.lock);
l2tp_recv_dequeue_skb(session, skb); l2tp_recv_dequeue_skb(session, skb);
spin_lock_bh(&session->reorder_q.lock); goto start;
} }
out: out:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment