diff options
| author |   Guillaume Nault <g.nault@alphalink.fr> | 2018-04-19 16:20:48 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-04-22 14:46:35 -0400 |
| commit | 5411b6187adf62909e3b998ac782e722904c7487 (patch) | |
| tree | 6436022361ecbc67d743c3aa22e00696b1ce71f2 /net/llc/llc_c_ac.c | |
| parent | Merge branch 's390-qeth-fixes' (diff) | |
| download | linux-dev-5411b6187adf62909e3b998ac782e722904c7487.tar.xz linux-dev-5411b6187adf62909e3b998ac782e722904c7487.zip | |
l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow
Commit 0e0c3fee3a59 ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
assumed that if pppol2tp_seq_stop() was called with non-NULL private
data (the 'v' pointer), then pppol2tp_seq_start() would not be called
again. It turns out that this isn't guaranteed, and overflowing the
seq_file's buffer in pppol2tp_seq_show() is a way to get into this
situation.
Therefore, pppol2tp_seq_stop() needs to reset pd->tunnel, so that
pppol2tp_seq_start() won't drop a reference again if it gets called.
We also have to clear pd->session, because the rest of the code expects
a non-NULL tunnel when pd->session is set.
The l2tp_debugfs module has the same issue. Fix it in the same way.
Fixes: 0e0c3fee3a59 ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
Fixes: f726214d9b23 ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/llc/llc_c_ac.c')
0 files changed, 0 insertions, 0 deletions