diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2009-10-19 08:41:58 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-10-20 06:34:20 +0200 |
| commit | 55b8050353c4a212c94d7156e2bd5885225b869b (patch) | |
| tree | 013778c4d48b946b2c565f8b55f40e505ec255ce /net/ipv4/ip_sockglue.c | |
| parent | bluetooth: static lock key fix (diff) | |
| download | linux-55b8050353c4a212c94d7156e2bd5885225b869b.tar.xz linux-55b8050353c4a212c94d7156e2bd5885225b869b.zip | |
net: Fix IP_MULTICAST_IF
ipv4/ipv6 setsockopt(IP_MULTICAST_IF) have dubious __dev_get_by_index() calls.
This function should be called only with RTNL or dev_base_lock held, or reader
could see a corrupt hash chain and eventually enter an endless loop.
Fix is to call dev_get_by_index()/dev_put().
If this happens to be performance critical, we could define a new dev_exist_by_index()
function to avoid touching dev refcount.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_sockglue.c')
| -rw-r--r-- | net/ipv4/ip_sockglue.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 0c0b6e363a20..e982b5c1ee17 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -634,17 +634,16 @@ static int do_ip_setsockopt(struct sock *sk, int level, break; } dev = ip_dev_find(sock_net(sk), mreq.imr_address.s_addr); - if (dev) { + if (dev) mreq.imr_ifindex = dev->ifindex; - dev_put(dev); - } } else - dev = __dev_get_by_index(sock_net(sk), mreq.imr_ifindex); + dev = dev_get_by_index(sock_net(sk), mreq.imr_ifindex); err = -EADDRNOTAVAIL; if (!dev) break; + dev_put(dev); err = -EINVAL; if (sk->sk_bound_dev_if && |