AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

l2tp: clean up stale tunnel or session in pppol2tp_connect's error path

Browse Source 
pppol2tp_connect() may create a tunnel or a session. Remove them in
case of error.

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Guillaume Nault 2018-06-13 15:09:21 +02:00 committed by David S. Miller
parent 3e1bc8bf97
commit bda06be215
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/l2tp/l2tp_ppp.c
View File

@ -612,6 +612,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
u32 session_id, peer_session_id; u32 session_id, peer_session_id;
bool drop_refcnt = false; bool drop_refcnt = false;
bool drop_tunnel = false; bool drop_tunnel = false;
bool new_session = false;
bool new_tunnel = false;
int ver = 2; int ver = 2;
int fd; int fd;
@ -722,6 +724,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
goto end; goto end;
} }
drop_tunnel = true; drop_tunnel = true;
new_tunnel = true;
} }
} else { } else {
/* Error if we can't find the tunnel */ /* Error if we can't find the tunnel */
@ -788,6 +791,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
goto end; goto end;
} }
drop_refcnt = true; drop_refcnt = true;
new_session = true;
} }
/* Special case: if source & dest session_id == 0x0000, this /* Special case: if source & dest session_id == 0x0000, this
@ -834,6 +838,12 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
session->name); session->name);
end: end:
if (error) {
if (new_session)
l2tp_session_delete(session);
if (new_tunnel)
l2tp_tunnel_delete(tunnel);
}
if (drop_refcnt) if (drop_refcnt)
l2tp_session_dec_refcount(session); l2tp_session_dec_refcount(session);
if (drop_tunnel) if (drop_tunnel)