Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

[mirror_ubuntu-bionic-kernel.git] / drivers / net / ppp / ppp_generic.c

diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index fc8ad001bc949e894e7659301af65565a5a21046..931836e09a6b62f3b34de3f6490e655bf05ce1eb 100644 (file)
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -443,9 +443,14 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
                         * network traffic (demand mode).
                         */
                        struct ppp *ppp = PF_TO_PPP(pf);
+
+                       ppp_recv_lock(ppp);
                        if (ppp->n_channels == 0 &&
-                           (ppp->flags & SC_LOOP_TRAFFIC) == 0)
+                           (ppp->flags & SC_LOOP_TRAFFIC) == 0) {
+                               ppp_recv_unlock(ppp);
                                break;
+                       }
+                       ppp_recv_unlock(ppp);
                }
                ret = -EAGAIN;
                if (file->f_flags & O_NONBLOCK)
@@ -532,9 +537,12 @@ static unsigned int ppp_poll(struct file *file, poll_table *wait)
        else if (pf->kind == INTERFACE) {
                /* see comment in ppp_read */
                struct ppp *ppp = PF_TO_PPP(pf);
+
+               ppp_recv_lock(ppp);
                if (ppp->n_channels == 0 &&
                    (ppp->flags & SC_LOOP_TRAFFIC) == 0)
                        mask |= POLLIN | POLLRDNORM;
+               ppp_recv_unlock(ppp);
        }
 
        return mask;
@@ -2429,13 +2437,15 @@ ppp_set_compress(struct ppp *ppp, unsigned long arg)
        unsigned char ccp_option[CCP_MAX_OPTION_LENGTH];
 
        err = -EFAULT;
-       if (copy_from_user(&data, (void __user *) arg, sizeof(data)) ||
-           (data.length <= CCP_MAX_OPTION_LENGTH &&
-            copy_from_user(ccp_option, (void __user *) data.ptr, data.length)))
+       if (copy_from_user(&data, (void __user *) arg, sizeof(data)))
+               goto out;
+       if (data.length > CCP_MAX_OPTION_LENGTH)
+               goto out;
+       if (copy_from_user(ccp_option, (void __user *) data.ptr, data.length))
                goto out;
+
        err = -EINVAL;
-       if (data.length > CCP_MAX_OPTION_LENGTH ||
-           ccp_option[1] < 2 || ccp_option[1] > data.length)
+       if (data.length < 2 || ccp_option[1] < 2 || ccp_option[1] > data.length)
                goto out;
 
        cp = try_then_request_module(
@@ -2808,6 +2818,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
 
 out2:
        mutex_unlock(&pn->all_ppp_mutex);
+       rtnl_unlock();
        free_netdev(dev);
 out1:
        *retp = ret;