Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f16270f authored by David S. Miller's avatar David S. Miller
Browse files

l2tp: Fix locking in l2tp_ip.c 



Both l2tp_ip_connect() and l2tp_ip_sendmsg() must take the socket
lock.  They both modify socket state non-atomically, and in particular
l2tp_ip_sendmsg() increments socket private counters without using
atomic operations.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent da905bd1

net/l2tp/l2tp_ip.c

+15 −4
Original line number Diff line number Diff line
@@ -311,6 +311,8 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len 
	if (lsa->l2tp_family != AF_INET)

		goto out;



	lock_sock(sk);



	sk_dst_reset(sk);



	oif = sk->sk_bound_dev_if;
@@ -356,6 +358,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len 


	rc = 0;

out:

	release_sock(sk);

	return rc;

}
@@ -420,18 +423,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m 
	int connected = 0;

	__be32 daddr;



	lock_sock(sk);



	rc = -ENOTCONN;

	if (sock_flag(sk, SOCK_DEAD))

		return -ENOTCONN;

		goto out;



	/* Get and verify the address. */

	if (msg->msg_name) {

		struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name;

		rc = -EINVAL;

		if (msg->msg_namelen < sizeof(*lip))

			return -EINVAL;

			goto out;



		if (lip->l2tp_family != AF_INET) {

			rc = -EAFNOSUPPORT;

			if (lip->l2tp_family != AF_UNSPEC)

				return -EAFNOSUPPORT;

				goto out;

		}



		daddr = lip->l2tp_addr.s_addr;
@@ -510,12 +518,15 @@ error: 
		lsa->tx_errors++;

	}



out:

	release_sock(sk);

	return rc;



no_route:

	IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);

	kfree_skb(skb);

	return -EHOSTUNREACH;

	rc = -EHOSTUNREACH;

	goto out;

}



static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,