1 files changed, 19 insertions, 9 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c26172995511..bec01a3daf5b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1684,10 +1684,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 
         mutex_lock(&fanout_mutex);
 
-        err = -EINVAL;
-        if (!po->running)
-                goto out;
-
         err = -EALREADY;
         if (po->fanout)
                 goto out;
@@ -1749,7 +1745,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                 list_add(&match->list, &fanout_list);
         }
         err = -EINVAL;
-        if (match->type == type &&
+
+        spin_lock(&po->bind_lock);
+        if (po->running &&
+            match->type == type &&
             match->prot_hook.type == po->prot_hook.type &&
             match->prot_hook.dev == po->prot_hook.dev) {
                 err = -ENOSPC;
@@ -1761,6 +1760,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                         err = 0;
                 }
         }
+        spin_unlock(&po->bind_lock);
+
+        if (err && !refcount_read(&match->sk_ref)) {
+                list_del(&match->list);
+                kfree(match);
+        }
+
 out:
         if (err && rollover) {
                 kfree(rollover);
@@ -2834,6 +2840,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         struct virtio_net_hdr vnet_hdr = { 0 };
         int offset = 0;
         struct packet_sock *po = pkt_sk(sk);
+        bool has_vnet_hdr = false;
         int hlen, tlen, linear;
         int extra_len = 0;
 
@@ -2877,6 +2884,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 err = packet_snd_vnet_parse(msg, &len, &vnet_hdr);
                 if (err)
                         goto out_unlock;
+                has_vnet_hdr = true;
         }
 
         if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
@@ -2935,7 +2943,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->priority = sk->sk_priority;
         skb->mark = sockc.mark;
 
-        if (po->has_vnet_hdr) {
+        if (has_vnet_hdr) {
                 err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
                 if (err)
                         goto out_free;
@@ -3063,13 +3071,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
         int ret = 0;
         bool unlisted = false;
 
-        if (po->fanout)
-                return -EINVAL;
-
         lock_sock(sk);
         spin_lock(&po->bind_lock);
         rcu_read_lock();
 
+        if (po->fanout) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         if (name) {
                 dev = dev_get_by_name_rcu(sock_net(sk), name);
                 if (!dev) {