Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9e56baf authored by Guillaume Nault's avatar Guillaume Nault Committed by David S. Miller
Browse files

l2tp: hold tunnel in pppol2tp_connect() 



Use l2tp_tunnel_get() in pppol2tp_connect() to ensure the tunnel isn't
going to disappear while processing the rest of the function.

Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0b07194b

net/l2tp/l2tp_ppp.c

+6 −1
Original line number Diff line number Diff line
@@ -584,6 +584,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 
	u32 tunnel_id, peer_tunnel_id;

	u32 session_id, peer_session_id;

	bool drop_refcnt = false;

	bool drop_tunnel = false;

	int ver = 2;

	int fd;
@@ -652,7 +653,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 
	if (tunnel_id == 0)

		goto end;



	tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);

	tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id);

	if (tunnel)

		drop_tunnel = true;



	/* Special case: create tunnel context if session_id and

	 * peer_session_id is 0. Otherwise look up tunnel using supplied
@@ -781,6 +784,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 
end:

	if (drop_refcnt)

		l2tp_session_dec_refcount(session);

	if (drop_tunnel)

		l2tp_tunnel_dec_refcount(tunnel);

	release_sock(sk);



	return error;