Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl() 

commit f664e37dcc525768280cb94321424a09beb1c992 upstream.

If 'session' is not NULL and is not a PPP pseudo-wire, then we fail to
drop the reference taken by l2tp_session_get().

Fixes: ecd012e45ab5 ("l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: Also call session->deref in both cases]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
Guillaume Nault 2018-08-03 17:00:11 +02:00 committed by syphyr
parent e5640ccd3d
commit fde1171d1e
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/l2tp/l2tp_ppp.c
View File

@ -1210,15 +1210,22 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
l2tp_session_get(sock_net(sk), tunnel,
stats.session_id, true);
if (session && session->pwtype == L2TP_PWTYPE_PPP) {
err = pppol2tp_session_ioctl(session, cmd,
arg);
if (!session) {
err = -EBADR;
break;
}
if (session->pwtype != L2TP_PWTYPE_PPP) {
if (session->deref)
session->deref(session);
l2tp_session_dec_refcount(session);
} else {
err = -EBADR;
break;
}
err = pppol2tp_session_ioctl(session, cmd, arg);
if (session->deref)
session->deref(session);
l2tp_session_dec_refcount(session);
break;
}
#ifdef CONFIG_XFRM