1 files changed, 53 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0032-l2tp-fix-a-race-in-l2tp_ip_sendmsg.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0032-l2tp-fix-a-race-in-l2tp_ip_sendmsg.patch
new file mode 100644
index 00000000..60f8a9d5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0032-l2tp-fix-a-race-in-l2tp_ip_sendmsg.patch
@@ -0,0 +1,53 @@
+From a2ee8c14e43a7432b50a050cd07c06d43caa9314 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 8 Jun 2012 06:25:00 +0000
+Subject: [PATCH 32/49] l2tp: fix a race in l2tp_ip_sendmsg()
+
+[ Upstream commit 4399a4df98a63e30fd16e9d0cecc46ea92269e8f ]
+
+Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
+a race, in case IP route cache is disabled.
+
+In this case, we should not do the dst_release(&rt->dst), since it'll
+free the dst immediately, instead of waiting a RCU grace period.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: James Chapman <jchapman@katalix.com>
+Cc: Denys Fedoryshchenko <denys@visp.net.lb>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/l2tp/l2tp_ip.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 2fbbe1f..6c7e609 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -515,10 +515,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+                                           sk->sk_bound_dev_if);
+                if (IS_ERR(rt))
+                        goto no_route;
+-               if (connected)
++               if (connected) {
+                        sk_setup_caps(sk, &rt->dst);
+-               else
+-                       dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
++               } else {
++                       skb_dst_set(skb, &rt->dst);
++                       goto xmit;
++               }
+        }
+ 
+        /* We dont need to clone dst here, it is guaranteed to not disappear.
+@@ -526,6 +528,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+         */
+        skb_dst_set_noref(skb, &rt->dst);
+ 
++xmit:
+        /* Queue the packet to IP for output */
+        rc = ip_queue_xmit(skb, &inet->cork.fl);
+        rcu_read_unlock();
+-- 
+1.7.10
+