tipc: Fix race condition when creating socket or native port

This patch eliminates the (very remote) chance of a crash resulting
from a partially initialized socket or native port unexpectedly
receiving a message.  Now, during the creation of a socket or native
port, the underlying generic port's lock is not released until all
initialization required to handle incoming messages has been done.

Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 4 insertions, 1 deletions

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 230f9ca2ad6b..38f48795b40e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -188,6 +188,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
         const struct proto_ops *ops;
         socket_state state;
         struct sock *sk;
+        struct tipc_port *tp_ptr;
         u32 portref;
 
         /* Validate arguments */
@@ -225,7 +226,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
         /* Allocate TIPC port for socket to use */
 
         portref = tipc_createport_raw(sk, &dispatch, &wakeupdispatch,
-                                      TIPC_LOW_IMPORTANCE);
+                                      TIPC_LOW_IMPORTANCE, &tp_ptr);
         if (unlikely(portref == 0)) {
                 sk_free(sk);
                 return -ENOMEM;
@@ -241,6 +242,8 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
         sk->sk_backlog_rcv = backlog_rcv;
         tipc_sk(sk)->p = tipc_get_port(portref);
 
+        spin_unlock_bh(tp_ptr->lock);
+
         if (sock->state == SS_READY) {
                 tipc_set_portunreturnable(portref, 1);
                 if (sock->type == SOCK_DGRAM)