1 files changed, 12 insertions, 6 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fab9bbfdead5..89f2e8c1f4dc 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3593,19 +3593,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 switch (val) {
                 case TPACKET_V1:
                 case TPACKET_V2:
                 case TPACKET_V3:
-                        po->tp_version = val;
-                        return 0;
+                        break;
                 default:
                         return -EINVAL;
                 }
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_version = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_RESERVE:
         {
@@ -4109,6 +4115,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         /* Added to avoid minimal code churn */
         struct tpacket_req *req = &req_u->req;
 
+        lock_sock(sk);
         /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
         if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
                 net_warn_ratelimited("Tx-ring is not supported.\n");
@@ -4190,7 +4197,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
         }
 
-        lock_sock(sk);
 
         /* Detach socket from network */
         spin_lock(&po->bind_lock);
@@ -4239,11 +4245,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);
         }
-        release_sock(sk);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
+        release_sock(sk);
         return err;
 }