l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl()
commit f664e37dcc525768280cb94321424a09beb1c992 upstream. If 'session' is not NULL and is not a PPP pseudo-wire, then we fail to drop the reference taken by l2tp_session_get(). Fixes: ecd012e45ab5 ("l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()") Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> [bwh: Backported to 3.16: Also call session->deref in both cases] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
e5640ccd3d
commit
fde1171d1e
|
@ -1210,15 +1210,22 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
|
||||||
l2tp_session_get(sock_net(sk), tunnel,
|
l2tp_session_get(sock_net(sk), tunnel,
|
||||||
stats.session_id, true);
|
stats.session_id, true);
|
||||||
|
|
||||||
if (session && session->pwtype == L2TP_PWTYPE_PPP) {
|
if (!session) {
|
||||||
err = pppol2tp_session_ioctl(session, cmd,
|
err = -EBADR;
|
||||||
arg);
|
break;
|
||||||
|
}
|
||||||
|
if (session->pwtype != L2TP_PWTYPE_PPP) {
|
||||||
if (session->deref)
|
if (session->deref)
|
||||||
session->deref(session);
|
session->deref(session);
|
||||||
l2tp_session_dec_refcount(session);
|
l2tp_session_dec_refcount(session);
|
||||||
} else {
|
|
||||||
err = -EBADR;
|
err = -EBADR;
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
err = pppol2tp_session_ioctl(session, cmd, arg);
|
||||||
|
if (session->deref)
|
||||||
|
session->deref(session);
|
||||||
|
l2tp_session_dec_refcount(session);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
#ifdef CONFIG_XFRM
|
#ifdef CONFIG_XFRM
|
||||||
|
|
Loading…
Reference in New Issue