lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 162/294] l2tp: hold tunnel used while creating sessions with netlink
    3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Guillaume Nault <g.nault@alphalink.fr>

    commit e702c1204eb57788ef189c839c8c779368267d70 upstream.

    Use l2tp_tunnel_get() to retrieve tunnel, so that it can't go away on
    us. Otherwise l2tp_tunnel_destruct() might release the last reference
    count concurrently, thus freeing the tunnel while we're using it.

    Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
    Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/l2tp/l2tp_netlink.c | 21 ++++++++++++---------
    1 file changed, 12 insertions(+), 9 deletions(-)

    --- a/net/l2tp/l2tp_netlink.c
    +++ b/net/l2tp/l2tp_netlink.c
    @@ -422,8 +422,9 @@ static int l2tp_nl_cmd_session_create(st
    ret = -EINVAL;
    goto out;
    }
    +
    tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
    - tunnel = l2tp_tunnel_find(net, tunnel_id);
    + tunnel = l2tp_tunnel_get(net, tunnel_id);
    if (!tunnel) {
    ret = -ENODEV;
    goto out;
    @@ -431,24 +432,24 @@ static int l2tp_nl_cmd_session_create(st

    if (!info->attrs[L2TP_ATTR_SESSION_ID]) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);

    if (!info->attrs[L2TP_ATTR_PEER_SESSION_ID]) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    peer_session_id = nla_get_u32(info->attrs[L2TP_ATTR_PEER_SESSION_ID]);

    if (!info->attrs[L2TP_ATTR_PW_TYPE]) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    cfg.pw_type = nla_get_u16(info->attrs[L2TP_ATTR_PW_TYPE]);
    if (cfg.pw_type >= __L2TP_PWTYPE_MAX) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }

    if (tunnel->version > 2) {
    @@ -470,7 +471,7 @@ static int l2tp_nl_cmd_session_create(st
    u16 len = nla_len(info->attrs[L2TP_ATTR_COOKIE]);
    if (len > 8) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    cfg.cookie_len = len;
    memcpy(&cfg.cookie[0], nla_data(info->attrs[L2TP_ATTR_COOKIE]), len);
    @@ -479,7 +480,7 @@ static int l2tp_nl_cmd_session_create(st
    u16 len = nla_len(info->attrs[L2TP_ATTR_PEER_COOKIE]);
    if (len > 8) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    cfg.peer_cookie_len = len;
    memcpy(&cfg.peer_cookie[0], nla_data(info->attrs[L2TP_ATTR_PEER_COOKIE]), len);
    @@ -515,7 +516,7 @@ static int l2tp_nl_cmd_session_create(st
    if ((l2tp_nl_cmd_ops[cfg.pw_type] == NULL) ||
    (l2tp_nl_cmd_ops[cfg.pw_type]->session_create == NULL)) {
    ret = -EPROTONOSUPPORT;
    - goto out;
    + goto out_tunnel;
    }

    /* Check that pseudowire-specific params are present */
    @@ -525,7 +526,7 @@ static int l2tp_nl_cmd_session_create(st
    case L2TP_PWTYPE_ETH_VLAN:
    if (!info->attrs[L2TP_ATTR_VLAN_ID]) {
    ret = -EINVAL;
    - goto out;
    + goto out_tunnel;
    }
    break;
    case L2TP_PWTYPE_ETH:
    @@ -544,6 +545,8 @@ static int l2tp_nl_cmd_session_create(st
    ret = (*l2tp_nl_cmd_ops[cfg.pw_type]->session_create)(net, tunnel_id,
    session_id, peer_session_id, &cfg);

    +out_tunnel:
    + l2tp_tunnel_dec_refcount(tunnel);
    out:
    return ret;
    }
    \
     
     \ /
      Last update: 2017-11-08 20:58    [W:3.739 / U:0.888 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site