l2tp: hold reference on tunnels in netlink dumps

Browse source

commit 5846c131c3 upstream.

l2tp_tunnel_find_nth() is unsafe: no reference is held on the returned
tunnel, therefore it can be freed whenever the caller uses it.
This patch defines l2tp_tunnel_get_nth() which works similarly, but
also takes a reference on the returned tunnel. The caller then has to
drop it after it stops using the tunnel.

Convert netlink dumps to make them safe against concurrent tunnel
deletion.

Fixes: 309795f4be ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

...

This commit is contained in:

Guillaume Nault 2018-04-12 20:50:33 +02:00 • committed by Ben Hutchings

parent 11cc93ca42

commit ed933fb978

3 changed files with 30 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

20

net/l2tp/l2tp_core.c

View file

2

net/l2tp/l2tp_core.h

View file

11

net/l2tp/l2tp_netlink.c

View file