View Issue Details

IDProjectCategoryView StatusLast Update
0006687CentOS-6kernelpublic2013-10-01 09:07
ReporterZykov Ilya 
PriorityhighSeveritymajorReproducibilityalways
Status newResolutionopen 
PlatformLinuxOSCEntOSOS Version6
Product Version6.4 
Target VersionFixed in Version 
Summary0006687: l2tp: Fix UDP socket reference count bugs in the pppol2tp driver.
DescriptionSee: 2.6.32.40-longterm
https://lkml.org/lkml/2011/5/5/416
Steps To ReproduceSee: 2.6.32.40-longterm
https://lkml.org/lkml/2011/5/5/416
TagsNo tags attached.

Activities

Zykov Ilya

Zykov Ilya

2013-10-01 09:07

reporter  

l2tp_Fix_UDP_socket_reference_count_bugs_in_the_pppol2tp_driver.patch (910 bytes)
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/net/pppol2tp.c |    3 +++
 1 file changed, 3 insertions(+)
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -756,6 +756,7 @@ static int pppol2tp_recv_core(struct soc
 
 	/* Try to dequeue as many skbs from reorder_q as we can. */
 	pppol2tp_recv_dequeue(session);
+	sock_put(sock);
 
 	return 0;
 
@@ -772,6 +773,7 @@ discard_bad_csum:
 	UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);
 	tunnel->stats.rx_errors++;
 	kfree_skb(skb);
+	sock_put(sock);
 
 	return 0;
 
@@ -1658,6 +1660,7 @@ static int pppol2tp_connect(struct socke
 		if (tunnel_sock == NULL)
 			goto end;
 
+		sock_hold(tunnel_sock);
 		tunnel = tunnel_sock->sk_user_data;
 	} else {
 		tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);



Issue History

Date Modified Username Field Change
2013-10-01 09:07 Zykov Ilya New Issue
2013-10-01 09:07 Zykov Ilya File Added: l2tp_Fix_UDP_socket_reference_count_bugs_in_the_pppol2tp_driver.patch