- Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 1/7] ide-cd: don't clear rq_flags after blk_get_request
by Zheng Zengkai 12 Dec '22

12 Dec '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65K8D CVE: NA -------------------------------- Prepare to add a flag while initializing request, there are no functional changes. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/ide/ide-cd_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ide/ide-cd_ioctl.c b/drivers/ide/ide-cd_ioctl.c index 46f2df288c6a..932c4be4c88c 100644 --- a/drivers/ide/ide-cd_ioctl.c +++ b/drivers/ide/ide-cd_ioctl.c @@ -298,7 +298,7 @@ int ide_cdrom_reset(struct cdrom_device_info *cdi) rq = blk_get_request(drive->queue, REQ_OP_DRV_IN, 0); ide_req(rq)->type = ATA_PRIV_MISC; - rq->rq_flags = RQF_QUIET; + rq->rq_flags |= RQF_QUIET; blk_execute_rq(drive->queue, cd->disk, rq, 0); ret = scsi_req(rq)->result ? -EIO : 0; blk_put_request(rq); -- 2.20.1

1 6

[PATCH openEuler-5.10] iommu: Fix error handling in probe_acpi_namespace_devices()
by Zheng Zengkai 12 Dec '22

12 Dec '22

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I65QZY -------------------------------- Fix smatch error in probe_acpi_namespace_devices(). In probe_acpi_namespace_devices(), if device_to_iommu() returns NULL, unlock operation is needed before return. Fixes: d660222861c4 ("iommu/vt-d:Add support for detecting ACPI device, in RMRR") Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> --- drivers/iommu/intel/iommu.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 9e14cf9d875f..a1e56413600a 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4995,8 +4995,10 @@ static int __init probe_acpi_namespace_devices(void) } iommu = device_to_iommu(dev, &bus, &devfn); - if (!iommu) - return -ENODEV; + if (!iommu) { + ret = -ENODEV; + goto unlock; + } info = dmar_search_domain_by_dev_info(iommu->segment, bus, devfn); if (!info) { pn->dev->bus->iommu_ops = &intel_iommu_ops; @@ -5011,8 +5013,10 @@ static int __init probe_acpi_namespace_devices(void) } if (!pn_dev) { iommu = device_to_iommu(dev, &bus, &devfn); - if (!iommu) - return -ENODEV; + if (!iommu) { + ret = -ENODEV; + goto unlock; + } info = dmar_search_domain_by_dev_info(iommu->segment, bus, devfn); if (!info) { dev->bus->iommu_ops = &intel_iommu_ops; -- 2.20.1

1 0

[PATCH openEuler-22.03-LTS] List: add info for debugging list
by Wang ShaoBo 10 Dec '22

10 Dec '22

Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- include/linux/list.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index a18c87b63376..b858dc1ce663 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -7,6 +7,7 @@ #include <linux/poison.h> #include <linux/const.h> #include <linux/kernel.h> +#include <asm/bug.h> /* * Simple doubly linked list implementation. @@ -71,6 +72,17 @@ static inline void __list_add(struct list_head *new, new->next = next; new->prev = prev; WRITE_ONCE(prev->next, new); + + WARN_ON(next->prev != new); + WARN_ON(new->next != next); + WARN_ON(new->prev != prev); + WARN_ON(prev->next != new); + wmb(); + mb(); + WARN_ON(next->prev != new); + WARN_ON(new->next != next); + WARN_ON(new->prev != prev); + WARN_ON(prev->next != new); } /** @@ -111,6 +123,13 @@ static inline void __list_del(struct list_head * prev, struct list_head * next) { next->prev = prev; WRITE_ONCE(prev->next, next); + + WARN_ON(next->prev != prev); + WARN_ON(prev->next != next); + wmb(); + mb(); + WARN_ON(next->prev != prev); + WARN_ON(prev->next != next); } /* -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS 0/2] add debug info
by Wang ShaoBo 09 Dec '22

09 Dec '22

add debug info Wang ShaoBo (1): waitqueue: add info for debugging Yu Liao (1): timer: add info for debugging include/linux/dwait.h | 6 +++++ kernel/sched/wait.c | 39 +++++++++++++++++++++++++++++ kernel/time/timer.c | 8 ++++++ lib/list_debug.c | 57 +++++++++++++++++++++++++++++++++++++++---- 4 files changed, 105 insertions(+), 5 deletions(-) create mode 100644 include/linux/dwait.h -- 2.25.1

1 2

【知会】https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取
by Zhengzengkai 08 Dec '22

08 Dec '22

Hi All, https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取，后续合入openEuler-22.03-LTS-SP1分支的补丁，目标分支请提到openEuler-22.03-LTS-SP1分支，如需同步主干，请在PR中评论/sync OLK-5.10 或另提到OLK-5.10分支。谢谢！

1 0

[PATCH openEuler-5.10 01/37] sched: Fix null-ptr-deref in free_fair_sched_group
by Zheng Zengkai 08 Dec '22

08 Dec '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187419, https://gitee.com/openeuler/kernel/issues/I612FD ------------------------------- do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 ================================================================== BUG: KASAN: null-ptr-deref in rq_of kernel/sched/sched.h:1118 [inline] BUG: KASAN: null-ptr-deref in unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] BUG: KASAN: null-ptr-deref in free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 Read of size 8 at addr 0000000000000130 by task syz-executor100/223 CPU: 3 PID: 223 Comm: syz-executor100 Not tainted 5.10.0 #6 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:551 [inline] kasan_report+0x18c/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 rq_of kernel/sched/sched.h:1118 [inline] unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 sched_free_group kernel/sched/core.c:7767 [inline] sched_create_group+0x48/0xc0 kernel/sched/core.c:7798 cpu_cgroup_css_alloc+0x18/0x40 kernel/sched/core.c:7930 css_create+0x7c/0x4a0 kernel/cgroup/cgroup.c:5328 cgroup_apply_control_enable+0x288/0x340 kernel/cgroup/cgroup.c:3135 cgroup_apply_control kernel/cgroup/cgroup.c:3217 [inline] cgroup_subtree_control_write+0x668/0x8b0 kernel/cgroup/cgroup.c:3375 cgroup_file_write+0x1a8/0x37c kernel/cgroup/cgroup.c:3909 kernfs_fop_write_iter+0x220/0x2f4 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:1960 [inline] new_sync_write+0x260/0x370 fs/read_write.c:515 vfs_write+0x3dc/0x4ac fs/read_write.c:602 ksys_write+0xfc/0x200 fs/read_write.c:655 __do_sys_write fs/read_write.c:667 [inline] __se_sys_write fs/read_write.c:664 [inline] __arm64_sys_write+0x50/0x60 fs/read_write.c:664 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155 do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 So add check for tg->cfs_rq[i] before unthrottle_qos_sched_group() called. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7fa2eecac1f4..654e964b5c31 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -12157,7 +12157,7 @@ void free_fair_sched_group(struct task_group *tg) for_each_possible_cpu(i) { #ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq) + if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); #endif if (tg->cfs_rq) -- 2.20.1

1 36

[PATCH openEuler-1.0-LTS] mm/sharepool: Fix a double free problem caused by init_local_group
by Yongqiang Liu 08 Dec '22

08 Dec '22

From: Chen Jun <chenjun102(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I64Y5Y CVE: NA ------------------------------- If local_group_add_task fails in init_local_group. ida free the same id twice. init_local_group local_group_add_task // failed goto free_spg free_spg: free_sp_group_locked free_sp_group_id // free spg->id free_spg_id: free_new_spg_id // double free spg->id To fix it, return before calling free_new_spg_id. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 41ed3a3b8682..d2591c73a503 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -301,8 +301,8 @@ static int init_local_group(struct mm_struct *mm) spg = create_spg(spg_id, 0); if (IS_ERR(spg)) { - ret = PTR_ERR(spg); - goto free_spg_id; + free_new_spg_id(true, spg_id); + return PTR_ERR(spg); } master->local = spg; @@ -322,11 +322,9 @@ static int init_local_group(struct mm_struct *mm) return 0; free_spg: + /* spg_id is freed in free_sp_group_locked */ free_sp_group_locked(spg); master->local = NULL; -free_spg_id: - free_new_spg_id(true, spg_id); - return ret; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/25] linux-4.19.y inclusion
by Yongqiang Liu 08 Dec '22

08 Dec '22

Alexander Potapenko (2): mm: fs: initialize fsdata passed to write_begin/write_end interface ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network Arnd Bergmann (1): security: commoncap: fix -Wstringop-overread warning Baisong Zhong (1): bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() Chen Zhongjin (1): net, neigh: Fix null-ptr-deref in neigh_table_clear() Christian A. Ehrhardt (1): kernfs: fix use-after-free in __kernfs_remove Chuang Wang (1): net: macvlan: fix memory leaks of macvlan_common_newlink Daniil Tatianin (1): ring_buffer: Do not deactivate non-existant pages Eric Dumazet (1): macvlan: enforce a consistent minimal mtu Gaosheng Cui (1): capabilities: fix potential memleak on error path from vfs_getxattr_alloc() Ilpo Järvinen (2): serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250: Flush DMA Rx on RLSI Jiri Benc (1): net: gso: fix panic on frag_list with mixed head alloc types Kuniyuki Iwashima (1): tcp/udp: Make early_demux back namespacified. Li Qiang (1): kprobe: reverse kp->flags when arm_kprobe failed Neal Cardwell (1): tcp: fix indefinite deferral of RTO with SACK reneging Rik van Riel (1): mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Seth Jenkins (1): mm: /proc/pid/smaps_rollup: fix no vma's null-deref Wang Wensheng (1): ftrace: Optimize the allocation for mcount entries Xia Fukun (2): ida: don't use BUG_ON() for debugging signal handling: don't use BUG_ON() for debugging Xiu Jianfeng (1): ftrace: Fix null pointer dereference in ftrace_add_mod() Zhang Xiaoxu (1): nfs4: Fix kmemleak when allocate slot failed Zhengchao Shao (2): net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed ipv6: fix WARNING in ip6_route_net_exit_late() drivers/net/macvlan.c | 6 ++- drivers/tty/serial/8250/8250_port.c | 7 +++- fs/buffer.c | 4 +- fs/kernfs/dir.c | 5 ++- fs/namei.c | 2 +- fs/nfs/nfs4client.c | 1 + fs/proc/task_mmu.c | 2 +- include/net/protocol.h | 4 -- include/net/tcp.h | 2 + include/net/udp.h | 1 + kernel/kprobes.c | 5 ++- kernel/signal.c | 8 ++-- kernel/trace/ftrace.c | 3 +- kernel/trace/ring_buffer.c | 4 +- lib/idr.c | 4 +- mm/filemap.c | 2 +- mm/hugetlb.c | 2 +- net/bpf/test_run.c | 1 + net/core/neighbour.c | 2 +- net/core/net_namespace.c | 7 ++++ net/core/skbuff.c | 36 +++++++++--------- net/ipv4/af_inet.c | 14 +------ net/ipv4/ip_input.c | 32 ++++++++++------ net/ipv4/sysctl_net_ipv4.c | 59 +---------------------------- net/ipv4/tcp_input.c | 3 +- net/ipv6/addrlabel.c | 1 + net/ipv6/ip6_input.c | 23 +++++++---- net/ipv6/route.c | 14 +++++-- net/ipv6/tcp_ipv6.c | 9 +---- net/ipv6/udp.c | 9 +---- security/commoncap.c | 6 ++- 31 files changed, 127 insertions(+), 151 deletions(-) -- 2.25.1

1 25

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix u8 overflow
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Sungwoo Kim <iam(a)sung-woo.kim> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3E CVE: CVE-2022-45934 -------------------------------- By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@... Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 863ce43fa175..3b02e881cec1 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4151,7 +4151,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, chan->ident = cmd->ident; l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); - chan->num_conf_rsp++; + if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) + chan->num_conf_rsp++; /* Reset config buffer. */ chan->conf_len = 0; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] l2tp: Serialize access to sk_user_data with sk_callback_lock
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Jakub Sitnicki <jakub(a)cloudflare.com> mainline inclusion from mainline-v6.1-rc6 commit b68777d54fac21fc833ec26ea1a2a84f975ab035 category: bugfix bugzilla: 188056, https://gitee.com/src-openeuler/kernel/issues/I62RNU CVE: CVE-2022-4129 -------------------------------- sk->sk_user_data has multiple users, which are not compatible with each other. Writers must synchronize by grabbing the sk->sk_callback_lock. l2tp currently fails to grab the lock when modifying the underlying tunnel socket fields. Fix it by adding appropriate locking. We err on the side of safety and grab the sk_callback_lock also inside the sk_destruct callback overridden by l2tp, even though there should be no refs allowing access to the sock at the time when sk_destruct gets called. v4: - serialize write to sk_user_data in l2tp sk_destruct v3: - switch from sock lock to sk_callback_lock - document write-protection for sk_user_data v2: - update Fixes to point to origin of the bug - use real names in Reported/Tested-by tags Cc: Tom Parkin <tparkin(a)katalix.com> Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") Reported-by: Haowei Yan <g1042620637(a)gmail.com> Signed-off-by: Jakub Sitnicki <jakub(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/l2tp/l2tp_core.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sock.h | 2 +- net/l2tp/l2tp_core.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 273f8226dbff..adfb0219fc29 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -304,7 +304,7 @@ struct sock_common { * @sk_tskey: counter to disambiguate concurrent tstamp requests * @sk_zckey: counter to order MSG_ZEROCOPY notifications * @sk_socket: Identd and reporting IO signals - * @sk_user_data: RPC layer private data + * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. * @sk_frag: cached page frag * @sk_peek_off: current peek_offset value * @sk_send_head: front of stuff to transmit diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 9abdc0a04d99..a88e1fd1cfea 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1172,8 +1172,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) } /* Remove hooks into tunnel socket */ + write_lock_bh(&sk->sk_callback_lock); sk->sk_destruct = tunnel->old_sk_destruct; sk->sk_user_data = NULL; + write_unlock_bh(&sk->sk_callback_lock); /* Call the original destructor */ if (sk->sk_destruct) @@ -1492,12 +1494,15 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock = sockfd_lookup(tunnel->fd, &ret); if (!sock) goto err; - - ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); - if (ret < 0) - goto err_sock; } + sk = sock->sk; + write_lock(&sk->sk_callback_lock); + + ret = l2tp_validate_socket(sk, net, tunnel->encap); + if (ret < 0) + goto err_sock; + tunnel->l2tp_net = net; pn = l2tp_pernet(net); @@ -1513,7 +1518,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); spin_unlock_bh(&pn->l2tp_tunnel_list_lock); - sk = sock->sk; sock_hold(sk); tunnel->sock = sk; @@ -1527,7 +1531,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, setup_udp_tunnel_sock(net, sock, &udp_cfg); } else { - sk->sk_user_data = tunnel; + rcu_assign_sk_user_data(sk, tunnel); } tunnel->old_sk_destruct = sk->sk_destruct; @@ -1539,6 +1543,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, if (tunnel->fd >= 0) sockfd_put(sock); + write_unlock(&sk->sk_callback_lock); return 0; err_sock: @@ -1546,6 +1551,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock_release(sock); else sockfd_put(sock); + + write_unlock(&sk->sk_callback_lock); err: return ret; } -- 2.25.1

1 1