linux/net/l2tp
Guillaume Nault 5411b6187a l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow
Commit 0e0c3fee3a ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
assumed that if pppol2tp_seq_stop() was called with non-NULL private
data (the 'v' pointer), then pppol2tp_seq_start() would not be called
again. It turns out that this isn't guaranteed, and overflowing the
seq_file's buffer in pppol2tp_seq_show() is a way to get into this
situation.

Therefore, pppol2tp_seq_stop() needs to reset pd->tunnel, so that
pppol2tp_seq_start() won't drop a reference again if it gets called.
We also have to clear pd->session, because the rest of the code expects
a non-NULL tunnel when pd->session is set.

The l2tp_debugfs module has the same issue. Fix it in the same way.

Fixes: 0e0c3fee3a ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
Fixes: f726214d9b ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-04-22 14:46:35 -04:00
..
Kconfig l2tp: Call udp_sock_create 2014-07-14 16:12:15 -07:00
l2tp_core.c l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file 2018-04-13 12:17:26 -04:00
l2tp_core.h l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file 2018-04-13 12:17:26 -04:00
l2tp_debugfs.c l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow 2018-04-22 14:46:35 -04:00
l2tp_eth.c l2tp: remove .tunnel_sock from struct l2tp_eth 2017-11-11 22:08:23 +09:00
l2tp_ip6.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-03-06 01:20:46 -05:00
l2tp_ip.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-03-06 01:20:46 -05:00
l2tp_netlink.c l2tp: hold reference on tunnels in netlink dumps 2018-04-13 12:17:26 -04:00
l2tp_ppp.c l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow 2018-04-22 14:46:35 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00