summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2011-05-08 13:39:01 -0700
committerDavid S. Miller <davem@davemloft.net>2011-05-08 13:39:01 -0700
commit2f16270f41e1499e23e6be25c51be87d950ffc91 (patch)
treeb3d40d33c4ff5470eb3642d44064fe4ec4caff92
parentda905bd1d5a6480d206f4b3dc61243f95adfae2c (diff)
downloadlinux-2f16270f41e1499e23e6be25c51be87d950ffc91.tar.bz2
l2tp: Fix locking in l2tp_ip.c
Both l2tp_ip_connect() and l2tp_ip_sendmsg() must take the socket lock. They both modify socket state non-atomically, and in particular l2tp_ip_sendmsg() increments socket private counters without using atomic operations. Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/l2tp/l2tp_ip.c19
1 files changed, 15 insertions, 4 deletions
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 81899600abe2..bd0cc0b8f32f 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -311,6 +311,8 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
if (lsa->l2tp_family != AF_INET)
goto out;
+ lock_sock(sk);
+
sk_dst_reset(sk);
oif = sk->sk_bound_dev_if;
@@ -356,6 +358,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
rc = 0;
out:
+ release_sock(sk);
return rc;
}
@@ -420,18 +423,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
int connected = 0;
__be32 daddr;
+ lock_sock(sk);
+
+ rc = -ENOTCONN;
if (sock_flag(sk, SOCK_DEAD))
- return -ENOTCONN;
+ goto out;
/* Get and verify the address. */
if (msg->msg_name) {
struct sockaddr_l2tpip *lip = (struct sockaddr_l2tpip *) msg->msg_name;
+ rc = -EINVAL;
if (msg->msg_namelen < sizeof(*lip))
- return -EINVAL;
+ goto out;
if (lip->l2tp_family != AF_INET) {
+ rc = -EAFNOSUPPORT;
if (lip->l2tp_family != AF_UNSPEC)
- return -EAFNOSUPPORT;
+ goto out;
}
daddr = lip->l2tp_addr.s_addr;
@@ -510,12 +518,15 @@ error:
lsa->tx_errors++;
}
+out:
+ release_sock(sk);
return rc;
no_route:
IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
kfree_skb(skb);
- return -EHOSTUNREACH;
+ rc = -EHOSTUNREACH;
+ goto out;
}
static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,