Commit 0908cf4d authored by linzhang's avatar linzhang Committed by David S. Miller

net: llc: add lock_sock in llc_ui_bind to avoid a race condition

There is a race condition in llc_ui_bind if two or more processes/threads
try to bind a same socket.

If more processes/threads bind a same socket success that will lead to
two problems, one is this action is not what we expected, another is
will lead to kernel in unstable status or oops(in my simple test case,
cause llc2.ko can't unload).

The current code is test SOCK_ZAPPED bit to avoid a process to
bind a same socket twice but that is can't avoid more processes/threads
try to bind a same socket at the same time.

So, add lock_sock in llc_ui_bind like others, such as llc_ui_connect.
Signed-off-by: default avatarLin Zhang <xiaolou4617@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 797a9364
...@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) ...@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
int rc = -EINVAL; int rc = -EINVAL;
dprintk("%s: binding %02X\n", __func__, addr->sllc_sap); dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
lock_sock(sk);
if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
goto out; goto out;
rc = -EAFNOSUPPORT; rc = -EAFNOSUPPORT;
...@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) ...@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
out_put: out_put:
llc_sap_put(sap); llc_sap_put(sap);
out: out:
release_sock(sk);
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment