Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3c18422 authored by Guillaume Nault's avatar Guillaume Nault Committed by David S. Miller
Browse files

l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() 



Socket must be held while under the protection of the l2tp lock; there
is no guarantee that sk remains valid after the read_unlock_bh() call.

Same issue for l2tp_ip and l2tp_ip6.

Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0382a25a

net/l2tp/l2tp_ip.c

+6 −5
Original line number Diff line number Diff line
@@ -183,13 +183,14 @@ static int l2tp_ip_recv(struct sk_buff *skb) 


		read_lock_bh(&l2tp_ip_lock);

		sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);

		if (!sk) {

			read_unlock_bh(&l2tp_ip_lock);

	}



	if (sk == NULL)

			goto discard;

		}



		sock_hold(sk);

		read_unlock_bh(&l2tp_ip_lock);

	}



	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_put;

net/l2tp/l2tp_ip6.c

+6 −5
Original line number Diff line number Diff line
@@ -198,13 +198,14 @@ static int l2tp_ip6_recv(struct sk_buff *skb) 
		read_lock_bh(&l2tp_ip6_lock);

		sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,

					    0, tunnel_id);

		if (!sk) {

			read_unlock_bh(&l2tp_ip6_lock);

	}



	if (sk == NULL)

			goto discard;

		}



		sock_hold(sk);

		read_unlock_bh(&l2tp_ip6_lock);

	}



	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_put;