summaryrefslogtreecommitdiff
path: root/net/rxrpc/security.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2016-09-30 00:37:15 +0300
committerDavid Howells <dhowells@redhat.com>2016-09-30 00:57:47 +0300
commit1e9e5c9521d3667664a6e3c97075f71afec23720 (patch)
treefb2447d0038b67d5ee980ab075047db2311ee308 /net/rxrpc/security.c
parent2629c7fa7c0adfdf023051b404cd538951bd0354 (diff)
downloadlinux-1e9e5c9521d3667664a6e3c97075f71afec23720.tar.xz
rxrpc: Reduce the rxrpc_local::services list to a pointer
Reduce the rxrpc_local::services list to just a pointer as we don't permit multiple service endpoints to bind to a single transport endpoints (this is excluded by rxrpc_lookup_local()). The reason we don't allow this is that if you send a request to an AFS filesystem service, it will try to talk back to your cache manager on the port you sent from (this is how file change notifications are handled). To prevent someone from stealing your CM callbacks, we don't let AF_RXRPC sockets share a UDP socket if at least one of them has a service bound. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net/rxrpc/security.c')
-rw-r--r--net/rxrpc/security.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/net/rxrpc/security.c b/net/rxrpc/security.c
index 82d8134e9287..7d921e56e715 100644
--- a/net/rxrpc/security.c
+++ b/net/rxrpc/security.c
@@ -131,10 +131,10 @@ int rxrpc_init_server_conn_security(struct rxrpc_connection *conn)
/* find the service */
read_lock(&local->services_lock);
- hlist_for_each_entry(rx, &local->services, listen_link) {
- if (rx->srx.srx_service == conn->params.service_id)
- goto found_service;
- }
+ rx = rcu_dereference_protected(local->service,
+ lockdep_is_held(&local->services_lock));
+ if (rx && rx->srx.srx_service == conn->params.service_id)
+ goto found_service;
/* the service appears to have died */
read_unlock(&local->services_lock);