summaryrefslogtreecommitdiff
path: root/net/l2tp
diff options
context:
space:
mode:
authorTom Parkin <tparkin@katalix.com>2012-10-29 23:41:48 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-11-17 13:16:18 -0800
commit988aaa6d344cdd838db420919dc26b3c0248e65a (patch)
treece7c5b0844149c44960a24320df8f3fd1bbe4a01 /net/l2tp
parent808235fefa3de34ff292cc86b0edfad17a6f056e (diff)
l2tp: fix oops in l2tp_eth_create() error path
[ Upstream commit 789336360e0a2aeb9750c16ab704a02cbe035e9e ] When creating an L2TPv3 Ethernet session, if register_netdev() should fail for any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the 32k-interface limit), the netdev is freed in the error path. However, the l2tp_eth_sess structure's dev pointer is left uncleared, and this results in l2tp_eth_delete() then attempting to unregister the same netdev later in the session teardown. This results in an oops. To avoid this, clear the session dev pointer in the error path. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/l2tp')
-rw-r--r--net/l2tp/l2tp_eth.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 5c829077b256..ab9a293ad034 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -269,6 +269,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
out_del_dev:
free_netdev(dev);
+ spriv->dev = NULL;
out_del_session:
l2tp_session_delete(session);
out: