Guillaume Nault d5e3a19093 l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() ... It's not enough to check for sockets bound to same address at the beginning of l2tp_ip{,6}_bind(): even if no socket is found at that time, a socket with the same address could be bound before we take the l2tp lock again. This patch moves the lookup right before inserting the new socket, so that no change can ever happen to the list between address lookup and socket insertion. Care is taken to avoid side effects on the socket in case of failure. That is, modifications of the socket are done after the lookup, when binding is guaranteed to succeed, and before releasing the l2tp lock, so that concurrent lookups will always see fully initialised sockets. For l2tp_ip, 'ret' is set to -EINVAL before checking the SOCK_ZAPPED bit. Error code was mistakenly set to -EADDRINUSE on error by commit 32c231164b ("l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()"). Using -EINVAL restores original behaviour. For l2tp_ip6, the lookup is now always done with the correct bound device. Before this patch, when binding to a link-local address, the lookup was done with the original sk->sk_bound_dev_if, which was later overwritten with addr->l2tp_scope_id. Lookup is now performed with the final sk->sk_bound_dev_if value. Finally, the (addr_len >= sizeof(struct sockaddr_in6)) check has been dropped: addr is a sockaddr_l2tpip6 not sockaddr_in6 and addr_len has already been checked at this point (this part of the code seems to have been copy-pasted from net/ipv6/raw.c). Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-11-30 14:14:08 -05:00
..
Kconfig	l2tp: Call udp_sock_create	2014-07-14 16:12:15 -07:00
l2tp_core.c	l2tp: fix use-after-free during module unload	2016-09-02 11:44:44 -07:00
l2tp_core.h	l2tp: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
l2tp_debugfs.c	ipv6: make lookups simpler and faster	2013-10-09 00:01:25 -04:00
l2tp_eth.c	net: revert "net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit"	2016-11-23 20:18:36 -05:00
l2tp_ip6.c	l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()	2016-11-30 14:14:08 -05:00
l2tp_ip.c	l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()	2016-11-30 14:14:08 -05:00
l2tp_netlink.c	l2tp: make nla_policy const	2016-09-01 14:09:01 -07:00
l2tp_ppp.c	l2tp: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
Makefile	l2tp: introduce L2TPv3 IP encapsulation support for IPv6	2012-05-01 09:30:55 -04:00