Commit 4399a4df authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

l2tp: fix a race in l2tp_ip_sendmsg()

Commit 081b1b1b

 (l2tp: fix l2tp_ip_sendmsg() route handling) added
a race, in case IP route cache is disabled.

In this case, we should not do the dst_release(&rt->dst), since it'll
free the dst immediately, instead of waiting a RCU grace period.
Signed-off-by: default avatarEric Dumazet <>
Cc: James Chapman <>
Cc: Denys Fedoryshchenko <>
Signed-off-by: default avatarDavid S. Miller <>
parent 6a2b28ef
......@@ -464,10 +464,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
if (IS_ERR(rt))
goto no_route;
if (connected)
if (connected) {
sk_setup_caps(sk, &rt->dst);
dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
} else {
skb_dst_set(skb, &rt->dst);
goto xmit;
/* We dont need to clone dst here, it is guaranteed to not disappear.
......@@ -475,6 +477,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
skb_dst_set_noref(skb, &rt->dst);
/* Queue the packet to IP for output */
rc = ip_queue_xmit(skb, &inet->cork.fl);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment