l2tp: fix race in pppol2tp_release with session object destroy

[pandora-kernel.git] / net / ipv6 / tunnel6.c

diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index d986472..aa109da 100644 (file)
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -30,23 +30,26 @@
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm6_tunnel *tunnel6_handlers __read_mostly;
-static struct xfrm6_tunnel *tunnel46_handlers __read_mostly;
+static struct xfrm6_tunnel __rcu *tunnel6_handlers __read_mostly;
+static struct xfrm6_tunnel __rcu *tunnel46_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel6_mutex);
 
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
 {
-       struct xfrm6_tunnel **pprev;
+       struct xfrm6_tunnel __rcu **pprev;
+       struct xfrm6_tunnel *t;
        int ret = -EEXIST;
        int priority = handler->priority;
 
        mutex_lock(&tunnel6_mutex);
 
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-            *pprev; pprev = &(*pprev)->next) {
-               if ((*pprev)->priority > priority)
+            (t = rcu_dereference_protected(*pprev,
+                       lockdep_is_held(&tunnel6_mutex))) != NULL;
+            pprev = &t->next) {
+               if (t->priority > priority)
                        break;
-               if ((*pprev)->priority == priority)
+               if (t->priority == priority)
                        goto err;
        }
 
@@ -65,14 +68,17 @@ EXPORT_SYMBOL(xfrm6_tunnel_register);
 
 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 {
-       struct xfrm6_tunnel **pprev;
+       struct xfrm6_tunnel __rcu **pprev;
+       struct xfrm6_tunnel *t;
        int ret = -ENOENT;
 
        mutex_lock(&tunnel6_mutex);
 
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-            *pprev; pprev = &(*pprev)->next) {
-               if (*pprev == handler) {
+            (t = rcu_dereference_protected(*pprev,
+                       lockdep_is_held(&tunnel6_mutex))) != NULL;
+            pprev = &t->next) {
+               if (t == handler) {
                        *pprev = handler->next;
                        ret = 0;
                        break;
@@ -139,6 +145,16 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        break;
 }
 
+static void tunnel46_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                        u8 type, u8 code, int offset, __be32 info)
+{
+       struct xfrm6_tunnel *handler;
+
+       for_each_tunnel_rcu(tunnel46_handlers, handler)
+               if (!handler->err_handler(skb, opt, type, code, offset, info))
+                       break;
+}
+
 static const struct inet6_protocol tunnel6_protocol = {
        .handler        = tunnel6_rcv,
        .err_handler    = tunnel6_err,
@@ -147,7 +163,7 @@ static const struct inet6_protocol tunnel6_protocol = {
 
 static const struct inet6_protocol tunnel46_protocol = {
        .handler        = tunnel46_rcv,
-       .err_handler    = tunnel6_err,
+       .err_handler    = tunnel46_err,
        .flags          = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };