1 files changed, 76 insertions, 80 deletions

diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index ebfa2967cd68..6f98834e6ace 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -207,7 +207,7 @@ static inline struct pppox_sock *get_item(unsigned long sid,
 
 static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp)
 {
-        struct net_device *dev = NULL;
+        struct net_device *dev;
         int ifindex;
 
         dev = dev_get_by_name(sp->sa_addr.pppoe.dev);
@@ -218,20 +218,6 @@ static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp)
         return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote, ifindex);
 }
 
-static inline int set_item(struct pppox_sock *po)
-{
-        int i;
-
-        if (!po)
-                return -EINVAL;
-
-        write_lock_bh(&pppoe_hash_lock);
-        i = __set_item(po);
-        write_unlock_bh(&pppoe_hash_lock);
-
-        return i;
-}
-
 static inline struct pppox_sock *delete_item(unsigned long sid, char *addr, int ifindex)
 {
         struct pppox_sock *ret;
@@ -255,54 +241,53 @@ static inline struct pppox_sock *delete_item(unsigned long sid, char *addr, int
 static void pppoe_flush_dev(struct net_device *dev)
 {
         int hash;
-
         BUG_ON(dev == NULL);
 
-        read_lock_bh(&pppoe_hash_lock);
+        write_lock_bh(&pppoe_hash_lock);
         for (hash = 0; hash < PPPOE_HASH_SIZE; hash++) {
                 struct pppox_sock *po = item_hash_table[hash];
 
                 while (po != NULL) {
-                        if (po->pppoe_dev == dev) {
-                                struct sock *sk = sk_pppox(po);
-
-                                sock_hold(sk);
-                                po->pppoe_dev = NULL;
+                        struct sock *sk = sk_pppox(po);
+                        if (po->pppoe_dev != dev) {
+                                po = po->next;
+                                continue;
+                        }
+                        po->pppoe_dev = NULL;
+                        dev_put(dev);
 
-                                /* We hold a reference to SK, now drop the
-                                 * hash table lock so that we may attempt
-                                 * to lock the socket (which can sleep).
-                                 */
-                                read_unlock_bh(&pppoe_hash_lock);
 
-                                lock_sock(sk);
+                        /* We always grab the socket lock, followed by the
+                         * pppoe_hash_lock, in that order.  Since we should
+                         * hold the sock lock while doing any unbinding,
+                         * we need to release the lock we're holding.
+                         * Hold a reference to the sock so it doesn't disappear
+                         * as we're jumping between locks.
+                         */
 
-                                if (sk->sk_state &
-                                    (PPPOX_CONNECTED | PPPOX_BOUND)) {
-                                        pppox_unbind_sock(sk);
-                                        dev_put(dev);
-                                        sk->sk_state = PPPOX_ZOMBIE;
-                                        sk->sk_state_change(sk);
-                                }
+                        sock_hold(sk);
 
-                                release_sock(sk);
+                        write_unlock_bh(&pppoe_hash_lock);
+                        lock_sock(sk);
 
-                                sock_put(sk);
+                        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+                                pppox_unbind_sock(sk);
+                                sk->sk_state = PPPOX_ZOMBIE;
+                                sk->sk_state_change(sk);
+                        }
 
-                                read_lock_bh(&pppoe_hash_lock);
+                        release_sock(sk);
+                        sock_put(sk);
 
-                                /* Now restart from the beginning of this
-                                 * hash chain.  We always NULL out pppoe_dev
-                                 * so we are guaranteed to make forward
-                                 * progress.
-                                 */
-                                po = item_hash_table[hash];
-                                continue;
-                        }
-                        po = po->next;
+                        /* Restart scan at the beginning of this hash chain.
+                         * While the lock was dropped the chain contents may
+                         * have changed.
+                         */
+                        write_lock_bh(&pppoe_hash_lock);
+                        po = item_hash_table[hash];
                 }
         }
-        read_unlock_bh(&pppoe_hash_lock);
+        write_unlock_bh(&pppoe_hash_lock);
 }
 
 static int pppoe_device_event(struct notifier_block *this,
@@ -344,10 +329,10 @@ static struct notifier_block pppoe_notifier = {
 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 {
         struct pppox_sock *po = pppox_sk(sk);
-        struct pppox_sock *relay_po = NULL;
+        struct pppox_sock *relay_po;
 
         if (sk->sk_state & PPPOX_BOUND) {
-                struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw;
+                struct pppoe_hdr *ph = pppoe_hdr(skb);
                 int len = ntohs(ph->length);
                 skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
                 if (pskb_trim_rcsum(skb, len))
@@ -401,7 +386,7 @@ static int pppoe_rcv(struct sk_buff *skb,
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
 
-        ph = (struct pppoe_hdr *) skb->nh.raw;
+        ph = pppoe_hdr(skb);
 
         po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
         if (po != NULL)
@@ -433,7 +418,7 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
 
-        ph = (struct pppoe_hdr *) skb->nh.raw;
+        ph = pppoe_hdr(skb);
         if (ph->code != PADT_CODE)
                 goto abort;
 
@@ -514,36 +499,49 @@ static int pppoe_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct pppox_sock *po;
-        int error = 0;
 
         if (!sk)
                 return 0;
 
-        if (sock_flag(sk, SOCK_DEAD))
+        lock_sock(sk);
+        if (sock_flag(sk, SOCK_DEAD)){
+                release_sock(sk);
                 return -EBADF;
+        }
 
         pppox_unbind_sock(sk);
 
         /* Signal the death of the socket. */
         sk->sk_state = PPPOX_DEAD;
 
+
+        /* Write lock on hash lock protects the entire "po" struct from
+         * concurrent updates via pppoe_flush_dev. The "po" struct should
+         * be considered part of the hash table contents, thus protected
+         * by the hash table lock */
+        write_lock_bh(&pppoe_hash_lock);
+
         po = pppox_sk(sk);
         if (po->pppoe_pa.sid) {
-                delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote, po->pppoe_ifindex);
+                __delete_item(po->pppoe_pa.sid,
+                              po->pppoe_pa.remote, po->pppoe_ifindex);
         }
 
-        if (po->pppoe_dev)
+        if (po->pppoe_dev) {
                 dev_put(po->pppoe_dev);
+                po->pppoe_dev = NULL;
+        }
 
-        po->pppoe_dev = NULL;
+        write_unlock_bh(&pppoe_hash_lock);
 
         sock_orphan(sk);
         sock->sk = NULL;
 
         skb_queue_purge(&sk->sk_receive_queue);
+        release_sock(sk);
         sock_put(sk);
 
-        return error;
+        return 0;
 }
 
 
@@ -599,14 +597,18 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                 po->pppoe_dev = dev;
                 po->pppoe_ifindex = dev->ifindex;
 
-                if (!(dev->flags & IFF_UP))
+                write_lock_bh(&pppoe_hash_lock);
+                if (!(dev->flags & IFF_UP)){
+                        write_unlock_bh(&pppoe_hash_lock);
                         goto err_put;
+                }
 
                 memcpy(&po->pppoe_pa,
                        &sp->sa_addr.pppoe,
                        sizeof(struct pppoe_addr));
 
-                error = set_item(po);
+                error = __set_item(po);
+                write_unlock_bh(&pppoe_hash_lock);
                 if (error < 0)
                         goto err_put;
 
@@ -762,10 +764,10 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
 static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
                   struct msghdr *m, size_t total_len)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         struct sock *sk = sock->sk;
         struct pppox_sock *po = pppox_sk(sk);
-        int error = 0;
+        int error;
         struct pppoe_hdr hdr;
         struct pppoe_hdr *ph;
         struct net_device *dev;
@@ -799,7 +801,7 @@ static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* Reserve space for headers. */
         skb_reserve(skb, dev->hard_header_len);
-        skb->nh.raw = skb->data;
+        skb_reset_network_header(skb);
 
         skb->dev = dev;
 
@@ -869,7 +871,8 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
                         goto abort;
 
                 skb_reserve(skb2, dev->hard_header_len + sizeof(struct pppoe_hdr));
-                memcpy(skb_put(skb2, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(skb2, skb->len),
+                                          skb->len);
         } else {
                 /* Make a clone so as to not disturb the original skb,
                  * give dev_queue_xmit something it can free.
@@ -884,7 +887,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
         memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
         skb2->protocol = __constant_htons(ETH_P_PPP_SES);
 
-        skb2->nh.raw = skb2->data;
+        skb_reset_network_header(skb2);
 
         skb2->dev = dev;
 
@@ -929,10 +932,8 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
                   struct msghdr *m, size_t total_len, int flags)
 {
         struct sock *sk = sock->sk;
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         int error = 0;
-        int len;
-        struct pppoe_hdr *ph = NULL;
 
         if (sk->sk_state & PPPOX_BOUND) {
                 error = -EIO;
@@ -942,26 +943,21 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &error);
 
-        if (error < 0) {
+        if (error < 0)
                 goto end;
-        }
 
         m->msg_namelen = 0;
 
         if (skb) {
-                error = 0;
-                ph = (struct pppoe_hdr *) skb->nh.raw;
-                len = ntohs(ph->length);
+                struct pppoe_hdr *ph = pppoe_hdr(skb);
+                const int len = ntohs(ph->length);
 
                 error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
-                if (error < 0)
-                        goto do_skb_free;
-                error = len;
+                if (error == 0)
+                        error = len;
         }
 
-do_skb_free:
-        if (skb)
-                kfree_skb(skb);
+        kfree_skb(skb);
 end:
         return error;
 }
@@ -991,7 +987,7 @@ out:
 
 static __inline__ struct pppox_sock *pppoe_get_idx(loff_t pos)
 {
-        struct pppox_sock *po = NULL;
+        struct pppox_sock *po;
         int i = 0;
 
         for (; i < PPPOE_HASH_SIZE; i++) {