diff options
| author | Guillaume Nault <g.nault@alphalink.fr> | 2018-06-13 15:09:21 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-06-14 17:10:19 -0700 |
| commit | bda06be2158c7aa7e41b15500c4d3840369c19a6 (patch) | |
| tree | 54edd9490c593c7e08c3a06cc0cb700cf3fc9bab /net | |
| parent | 3e1bc8bf974e2d4e7beb842a4c801c2542eff3bd (diff) | |
| download | linux-stable-bda06be2158c7aa7e41b15500c4d3840369c19a6.tar.gz linux-stable-bda06be2158c7aa7e41b15500c4d3840369c19a6.tar.bz2 linux-stable-bda06be2158c7aa7e41b15500c4d3840369c19a6.zip | |
l2tp: clean up stale tunnel or session in pppol2tp_connect's error path
pppol2tp_connect() may create a tunnel or a session. Remove them in
case of error.
Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/l2tp/l2tp_ppp.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 1b24f76ae210..f429fed06a1e 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -612,6 +612,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, u32 session_id, peer_session_id; bool drop_refcnt = false; bool drop_tunnel = false; + bool new_session = false; + bool new_tunnel = false; int ver = 2; int fd; @@ -722,6 +724,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, goto end; } drop_tunnel = true; + new_tunnel = true; } } else { /* Error if we can't find the tunnel */ @@ -788,6 +791,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, goto end; } drop_refcnt = true; + new_session = true; } /* Special case: if source & dest session_id == 0x0000, this @@ -834,6 +838,12 @@ out_no_ppp: session->name); end: + if (error) { + if (new_session) + l2tp_session_delete(session); + if (new_tunnel) + l2tp_tunnel_delete(tunnel); + } if (drop_refcnt) l2tp_session_dec_refcount(session); if (drop_tunnel) |