Commit 5411b618 authored by Guillaume Nault's avatar Guillaume Nault Committed by David S. Miller

l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow

Commit 0e0c3fee ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
assumed that if pppol2tp_seq_stop() was called with non-NULL private
data (the 'v' pointer), then pppol2tp_seq_start() would not be called
again. It turns out that this isn't guaranteed, and overflowing the
seq_file's buffer in pppol2tp_seq_show() is a way to get into this
situation.

Therefore, pppol2tp_seq_stop() needs to reset pd->tunnel, so that
pppol2tp_seq_start() won't drop a reference again if it gets called.
We also have to clear pd->session, because the rest of the code expects
a non-NULL tunnel when pd->session is set.

The l2tp_debugfs module has the same issue. Fix it in the same way.

Fixes: 0e0c3fee ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
Fixes: f726214d ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 353697e6
...@@ -106,8 +106,11 @@ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v) ...@@ -106,8 +106,11 @@ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
return; return;
/* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */ /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
if (pd->tunnel) if (pd->tunnel) {
l2tp_tunnel_dec_refcount(pd->tunnel); l2tp_tunnel_dec_refcount(pd->tunnel);
pd->tunnel = NULL;
pd->session = NULL;
}
} }
static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v) static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
......
...@@ -1618,8 +1618,11 @@ static void pppol2tp_seq_stop(struct seq_file *p, void *v) ...@@ -1618,8 +1618,11 @@ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
return; return;
/* Drop reference taken by last invocation of pppol2tp_next_tunnel() */ /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
if (pd->tunnel) if (pd->tunnel) {
l2tp_tunnel_dec_refcount(pd->tunnel); l2tp_tunnel_dec_refcount(pd->tunnel);
pd->tunnel = NULL;
pd->session = NULL;
}
} }
static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment