aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorTom Parkin <tparkin@katalix.com>2012-10-29 23:41:48 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-11-17 13:14:25 -0800
commit5a3e425d67aab6b6f0b3bd3fb372b8044b8e981b (patch)
treead81ab86f5ba8b81660d53ef46f47f6e57657a8e /net
parent798c7dba9071df9cdd935da16066e1a17580d9ee (diff)
downloadkernel_samsung_smdk4412-5a3e425d67aab6b6f0b3bd3fb372b8044b8e981b.zip
kernel_samsung_smdk4412-5a3e425d67aab6b6f0b3bd3fb372b8044b8e981b.tar.gz
kernel_samsung_smdk4412-5a3e425d67aab6b6f0b3bd3fb372b8044b8e981b.tar.bz2
l2tp: fix oops in l2tp_eth_create() error path
[ Upstream commit 789336360e0a2aeb9750c16ab704a02cbe035e9e ] When creating an L2TPv3 Ethernet session, if register_netdev() should fail for any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the 32k-interface limit), the netdev is freed in the error path. However, the l2tp_eth_sess structure's dev pointer is left uncleared, and this results in l2tp_eth_delete() then attempting to unregister the same netdev later in the session teardown. This results in an oops. To avoid this, clear the session dev pointer in the error path. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/l2tp/l2tp_eth.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 2cef50b..64164fb 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -269,6 +269,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
out_del_dev:
free_netdev(dev);
+ spriv->dev = NULL;
out_del_session:
l2tp_session_delete(session);
out: