summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorTom Parkin <tparkin@katalix.com>2012-10-30 03:41:48 +0400
committerDavid S. Miller <davem@davemloft.net>2012-11-03 05:56:35 +0400
commit789336360e0a2aeb9750c16ab704a02cbe035e9e (patch)
tree1568251a167183170cc25dd6aa5f1512f4e3d611 /net
parente3c98512780ae2cfb90be2152ab35294439bb7bb (diff)
downloadlinux-789336360e0a2aeb9750c16ab704a02cbe035e9e.tar.xz
l2tp: fix oops in l2tp_eth_create() error path
When creating an L2TPv3 Ethernet session, if register_netdev() should fail for any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the 32k-interface limit), the netdev is freed in the error path. However, the l2tp_eth_sess structure's dev pointer is left uncleared, and this results in l2tp_eth_delete() then attempting to unregister the same netdev later in the session teardown. This results in an oops. To avoid this, clear the session dev pointer in the error path. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/l2tp/l2tp_eth.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 37b8b8ba31f7..76125c57ee6d 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -291,6 +291,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
out_del_dev:
free_netdev(dev);
+ spriv->dev = NULL;
out_del_session:
l2tp_session_delete(session);
out: