Commit 778865a5 authored by David S. Miller's avatar David S. Miller

l2tp: Fix inet_opt conversion.

We don't actually hold the socket lock at this point, so the
rcu_dereference_protected() isn't' correct.  Thanks to Eric
Dumazet for pointing this out.

Thankfully, we're only interested in fetching the faddr value
if srr is enabled, so we can simply make this an RCU sequence
and use plain rcu_dereference().
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b801a4e7
...@@ -472,13 +472,15 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m ...@@ -472,13 +472,15 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
if (rt == NULL) { if (rt == NULL) {
struct ip_options_rcu *inet_opt; struct ip_options_rcu *inet_opt;
inet_opt = rcu_dereference_protected(inet->inet_opt, rcu_read_lock();
sock_owned_by_user(sk)); inet_opt = rcu_dereference(inet->inet_opt);
/* Use correct destination address if we have options. */ /* Use correct destination address if we have options. */
if (inet_opt && inet_opt->opt.srr) if (inet_opt && inet_opt->opt.srr)
daddr = inet_opt->opt.faddr; daddr = inet_opt->opt.faddr;
rcu_read_unlock();
/* If this fails, retransmit mechanism of transport layer will /* If this fails, retransmit mechanism of transport layer will
* keep trying until route appears or the connection times * keep trying until route appears or the connection times
* itself out. * itself out.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment