diff options
| author | Guillaume Nault <g.nault@alphalink.fr> | 2018-08-03 18:00:11 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-08-03 22:39:01 +0300 |
| commit | f664e37dcc525768280cb94321424a09beb1c992 (patch) | |
| tree | 6530e5e71d9a26b2ebd6313be7510ee1f0ae9088 | |
| parent | 60a01828f33051feec8bf74f74e980a163d5a208 (diff) | |
| download | linux-f664e37dcc525768280cb94321424a09beb1c992.tar.xz | |
l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl()
If 'session' is not NULL and is not a PPP pseudo-wire, then we fail to
drop the reference taken by l2tp_session_get().
Fixes: ecd012e45ab5 ("l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/l2tp/l2tp_ppp.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index e398797878a9..cf6cca260e7b 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, l2tp_session_get(sock_net(sk), tunnel, stats.session_id); - if (session && session->pwtype == L2TP_PWTYPE_PPP) { - err = pppol2tp_session_ioctl(session, cmd, - arg); + if (!session) { + err = -EBADR; + break; + } + if (session->pwtype != L2TP_PWTYPE_PPP) { l2tp_session_dec_refcount(session); - } else { err = -EBADR; + break; } + + err = pppol2tp_session_ioctl(session, cmd, arg); + l2tp_session_dec_refcount(session); break; } #ifdef CONFIG_XFRM |