diff options
author | Dmitry Mishin <dim@openvz.org> | 2006-08-31 18:28:39 -0400 |
---|---|---|
committer | David S. Miller <davem@sunset.davemloft.net> | 2006-09-22 18:18:47 -0400 |
commit | fda9ef5d679b07c9d9097aaf6ef7f069d794a8f9 (patch) | |
tree | 6a265dc2038bc5568c5a499e6c8d4733650ed3f7 /net/ipv6/tcp_ipv6.c | |
parent | dc435e6dac1439340eaeceef84022c4e4749796d (diff) |
[NET]: Fix sk->sk_filter field access
Function sk_filter() is called from tcp_v{4,6}_rcv() functions with arg
needlock = 0, while socket is not locked at that moment. In order to avoid
this and similar issues in the future, use rcu for sk->sk_filter field read
protection.
Signed-off-by: Dmitry Mishin <dim@openvz.org>
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Diffstat (limited to 'net/ipv6/tcp_ipv6.c')
-rw-r--r-- | net/ipv6/tcp_ipv6.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 2b18918f3011..2546fc9f0a78 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c | |||
@@ -1075,7 +1075,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) | |||
1075 | if (skb->protocol == htons(ETH_P_IP)) | 1075 | if (skb->protocol == htons(ETH_P_IP)) |
1076 | return tcp_v4_do_rcv(sk, skb); | 1076 | return tcp_v4_do_rcv(sk, skb); |
1077 | 1077 | ||
1078 | if (sk_filter(sk, skb, 0)) | 1078 | if (sk_filter(sk, skb)) |
1079 | goto discard; | 1079 | goto discard; |
1080 | 1080 | ||
1081 | /* | 1081 | /* |
@@ -1232,7 +1232,7 @@ process: | |||
1232 | if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) | 1232 | if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) |
1233 | goto discard_and_relse; | 1233 | goto discard_and_relse; |
1234 | 1234 | ||
1235 | if (sk_filter(sk, skb, 0)) | 1235 | if (sk_filter(sk, skb)) |
1236 | goto discard_and_relse; | 1236 | goto discard_and_relse; |
1237 | 1237 | ||
1238 | skb->dev = NULL; | 1238 | skb->dev = NULL; |