* [PATCH net] l2tp: initialise session's refcount before making it reachable
@ 2017-08-25 14:22 Guillaume Nault
2017-08-28 18:29 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Guillaume Nault @ 2017-08-25 14:22 UTC (permalink / raw)
To: netdev; +Cc: James Chapman, David Miller
Sessions must be fully initialised before calling
l2tp_session_add_to_tunnel(). Otherwise, there's a short time frame
where partially initialised sessions can be accessed by external users.
Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
---
net/l2tp/l2tp_core.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index b0c2d4ae781d..f363669eae47 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1844,6 +1844,8 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
l2tp_session_set_header_len(session, tunnel->version);
+ refcount_set(&session->ref_count, 1);
+
err = l2tp_session_add_to_tunnel(tunnel, session);
if (err) {
kfree(session);
@@ -1851,10 +1853,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
return ERR_PTR(err);
}
- /* Bump the reference count. The session context is deleted
- * only when this drops to zero.
- */
- refcount_set(&session->ref_count, 1);
l2tp_tunnel_inc_refcount(tunnel);
/* Ensure tunnel socket isn't deleted */
--
2.14.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] l2tp: initialise session's refcount before making it reachable
2017-08-25 14:22 [PATCH net] l2tp: initialise session's refcount before making it reachable Guillaume Nault
@ 2017-08-28 18:29 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2017-08-28 18:29 UTC (permalink / raw)
To: g.nault; +Cc: netdev, jchapman
From: Guillaume Nault <g.nault@alphalink.fr>
Date: Fri, 25 Aug 2017 16:22:17 +0200
> Sessions must be fully initialised before calling
> l2tp_session_add_to_tunnel(). Otherwise, there's a short time frame
> where partially initialised sessions can be accessed by external users.
>
> Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation")
> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-08-28 18:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-25 14:22 [PATCH net] l2tp: initialise session's refcount before making it reachable Guillaume Nault
2017-08-28 18:29 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.