Commit ff009403 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

l2tp: use add READ_ONCE() to fetch sk->sk_bound_dev_if 



Use READ_ONCE() in paths not holding the socket lock.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 70f87de9

net/l2tp/l2tp_ip.c

+3 −1
Original line number Diff line number Diff line
@@ -50,11 +50,13 @@ static struct sock *__l2tp_ip_bind_lookup(const struct net *net, __be32 laddr, 
	sk_for_each_bound(sk, &l2tp_ip_bind_table) {

		const struct l2tp_ip_sock *l2tp = l2tp_ip_sk(sk);

		const struct inet_sock *inet = inet_sk(sk);

		int bound_dev_if;



		if (!net_eq(sock_net(sk), net))

			continue;



		if (sk->sk_bound_dev_if && dif && sk->sk_bound_dev_if != dif)

		bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);

		if (bound_dev_if && dif && bound_dev_if != dif)

			continue;



		if (inet->inet_rcv_saddr && laddr &&

net/l2tp/l2tp_ip6.c

+5 −3
Original line number Diff line number Diff line
@@ -62,11 +62,13 @@ static struct sock *__l2tp_ip6_bind_lookup(const struct net *net, 
		const struct in6_addr *sk_laddr = inet6_rcv_saddr(sk);

		const struct in6_addr *sk_raddr = &sk->sk_v6_daddr;

		const struct l2tp_ip6_sock *l2tp = l2tp_ip6_sk(sk);

		int bound_dev_if;



		if (!net_eq(sock_net(sk), net))

			continue;



		if (sk->sk_bound_dev_if && dif && sk->sk_bound_dev_if != dif)

		bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);

		if (bound_dev_if && dif && bound_dev_if != dif)

			continue;



		if (sk_laddr && !ipv6_addr_any(sk_laddr) &&
@@ -445,7 +447,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr, 
		lsa->l2tp_conn_id = lsk->conn_id;

	}

	if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)

		lsa->l2tp_scope_id = sk->sk_bound_dev_if;

		lsa->l2tp_scope_id = READ_ONCE(sk->sk_bound_dev_if);

	return sizeof(*lsa);

}
@@ -560,7 +562,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	}



	if (fl6.flowi6_oif == 0)

		fl6.flowi6_oif = sk->sk_bound_dev_if;

		fl6.flowi6_oif = READ_ONCE(sk->sk_bound_dev_if);



	if (msg->msg_controllen) {

		opt = &opt_space;