l2tp: prevent creation of sessions on terminated tunnels

[pandora-kernel.git] / net / l2tp / l2tp_core.c

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index b539c78..5fa9068 100644 (file)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -335,13 +335,21 @@ static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
        struct hlist_head *head;
        struct l2tp_net *pn;
        struct hlist_node *walk;
+       int err;
 
        head = l2tp_session_id_hash(tunnel, session->session_id);
 
        write_lock_bh(&tunnel->hlist_lock);
+       if (!tunnel->acpt_newsess) {
+               err = -ENODEV;
+               goto err_tlock;
+       }
+
        hlist_for_each_entry(session_walk, walk, head, hlist)
-               if (session_walk->session_id == session->session_id)
-                       goto exist;
+               if (session_walk->session_id == session->session_id) {
+                       err = -EEXIST;
+                       goto err_tlock;
+               }
 
        if (tunnel->version == L2TP_HDR_VER_3) {
                pn = l2tp_pernet(tunnel->l2tp_net);
@@ -349,12 +357,21 @@ static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
                                                session->session_id);
 
                spin_lock_bh(&pn->l2tp_session_hlist_lock);
+
                hlist_for_each_entry(session_walk, walk, g_head, global_hlist)
-                       if (session_walk->session_id == session->session_id)
-                               goto exist_glob;
+                       if (session_walk->session_id == session->session_id) {
+                               err = -EEXIST;
+                               goto err_tlock_pnlock;
+                       }
 
+               l2tp_tunnel_inc_refcount(tunnel);
+               sock_hold(tunnel->sock);
                hlist_add_head_rcu(&session->global_hlist, g_head);
+
                spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+       } else {
+               l2tp_tunnel_inc_refcount(tunnel);
+               sock_hold(tunnel->sock);
        }
 
        hlist_add_head(&session->hlist, head);
@@ -362,12 +379,12 @@ static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
 
        return 0;
 
-exist_glob:
+err_tlock_pnlock:
        spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-exist:
+err_tlock:
        write_unlock_bh(&tunnel->hlist_lock);
 
-       return -EEXIST;
+       return err;
 }
 
 /* Lookup a tunnel by id
@@ -1282,6 +1299,7 @@ static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
               "%s: closing all sessions...\n", tunnel->name);
 
        write_lock_bh(&tunnel->hlist_lock);
+       tunnel->acpt_newsess = false;
        for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 again:
                hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
@@ -1504,6 +1522,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        tunnel->magic = L2TP_TUNNEL_MAGIC;
        sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
        rwlock_init(&tunnel->hlist_lock);
+       tunnel->acpt_newsess = true;
 
        /* The net we belong to */
        tunnel->l2tp_net = net;
@@ -1719,11 +1738,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                        return ERR_PTR(err);
                }
 
-               l2tp_tunnel_inc_refcount(tunnel);
-
-               /* Ensure tunnel socket isn't deleted */
-               sock_hold(tunnel->sock);
-
                /* Ignore management session in session count value */
                if (session->session_id != 0)
                        atomic_inc(&l2tp_session_count);