• Guillaume Nault's avatar
    l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow · 5411b618
    Guillaume Nault authored
    Commit 0e0c3fee ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
    assumed that if pppol2tp_seq_stop() was called with non-NULL private
    data (the 'v' pointer), then pppol2tp_seq_start() would not be called
    again. It turns out that this isn't guaranteed, and overflowing the
    seq_file's buffer in pppol2tp_seq_show() is a way to get into this
    situation.
    
    Therefore, pppol2tp_seq_stop() needs to reset pd->tunnel, so that
    pppol2tp_seq_start() won't drop a reference again if it gets called.
    We also have to clear pd->session, because the rest of the code expects
    a non-NULL tunnel when pd->session is set.
    
    The l2tp_debugfs module has the same issue. Fix it in the same way.
    
    Fixes: 0e0c3fee ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
    Fixes: f726214d ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
    Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5411b618
l2tp_ppp.c 46.9 KB