Acked-by: James Chapman <jchap...@katalix.com>
On 28 September 2015 at 10:32, Alexander Couzens <lyn...@fe80.eu> wrote:
> There is a small chance that tunnel_free() is called before tunnel->del_work
> scheduled
> resulting in a zero pointer dereference.
>
> Signed-off-by: Alexander Couzens <lyn...@fe80.eu>
> ---
> net/l2tp/l2tp_core.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
> index f6b090d..afca2eb 100644
> --- a/net/l2tp/l2tp_core.c
> +++ b/net/l2tp/l2tp_core.c
> @@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct work_struct
> *work)
> tunnel = container_of(work, struct l2tp_tunnel, del_work);
> sk = l2tp_tunnel_sock_lookup(tunnel);
> if (!sk)
> - return;
> + goto out;
>
> sock = sk->sk_socket;
>
> @@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct work_struct
> *work)
> }
>
> l2tp_tunnel_sock_put(sk);
> +out:
> + l2tp_tunnel_dec_refcount(tunnel);
> }
>
> /* Create a socket for the tunnel, if one isn't set up by
> @@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
> */
> int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
> {
> + l2tp_tunnel_inc_refcount(tunnel);
> l2tp_tunnel_closeall(tunnel);
> - return (false == queue_work(l2tp_wq, &tunnel->del_work));
> + if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
> + l2tp_tunnel_dec_refcount(tunnel);
> + return 1;
> + }
> + return 0;
> }
> EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
>
> --
> 2.5.3
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
