Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f664e37d authored by Guillaume Nault's avatar Guillaume Nault Committed by David S. Miller
Browse files

l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl() 



If 'session' is not NULL and is not a PPP pseudo-wire, then we fail to
drop the reference taken by l2tp_session_get().

Fixes: ecd012e4 ("l2tp: filter out non-PPP sessions in pppol2tp_tunnel_ioctl()")
Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 60a01828

net/l2tp/l2tp_ppp.c

+9 −4
Original line number Diff line number Diff line
@@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 
				l2tp_session_get(sock_net(sk), tunnel,

						 stats.session_id);



			if (session && session->pwtype == L2TP_PWTYPE_PPP) {

				err = pppol2tp_session_ioctl(session, cmd,

							     arg);

			if (!session) {

				err = -EBADR;

				break;

			}

			if (session->pwtype != L2TP_PWTYPE_PPP) {

				l2tp_session_dec_refcount(session);

			} else {

				err = -EBADR;

				break;

			}



			err = pppol2tp_session_ioctl(session, cmd, arg);

			l2tp_session_dec_refcount(session);

			break;

		}

#ifdef CONFIG_XFRM