l2tp: fix a race in l2tp_ip_sendmsg()

Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
a race, in case IP route cache is disabled.

In this case, we should not do the dst_release(&rt->dst), since it'll
free the dst immediately, instead of waiting a RCU grace period.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Cc: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 3 deletions

diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 70614e7affab..61d8b75d2686 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -464,10 +464,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                                            sk->sk_bound_dev_if);
                 if (IS_ERR(rt))
                         goto no_route;
-                if (connected)
+                if (connected) {
                         sk_setup_caps(sk, &rt->dst);
-                else
-                        dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
+                } else {
+                        skb_dst_set(skb, &rt->dst);
+                        goto xmit;
+                }
         }
 
         /* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -475,6 +477,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
          */
         skb_dst_set_noref(skb, &rt->dst);
 
+xmit:
         /* Queue the packet to IP for output */
         rc = ip_queue_xmit(skb, &inet->cork.fl);
         rcu_read_unlock();