summaryrefslogtreecommitdiff
path: root/net/l2tp/l2tp_core.c
diff options
context:
space:
mode:
authorTom Parkin <tparkin@katalix.com>2020-07-24 16:31:57 +0100
committerDavid S. Miller <davem@davemloft.net>2020-07-24 17:19:14 -0700
commitab6934e084e5eee665adf6e834e5096ebae4a95f (patch)
tree87056210a3a52fc56229ef5d44d0392d1fceb10e /net/l2tp/l2tp_core.c
parent0dd62f69d898de3cf31a2f8b59e9a62bb5448457 (diff)
l2tp: WARN_ON rather than BUG_ON in l2tp_session_free
l2tp_session_free called BUG_ON if the tunnel magic feather value wasn't correct. The intent of this was to catch lifetime bugs; for example early tunnel free due to incorrect use of reference counts. Since the tunnel magic feather being wrong indicates either early free or structure corruption, we can avoid doing more damage by simply leaving the tunnel structure alone. If the tunnel refcount isn't dropped when it should be, the tunnel instance will remain in the kernel, resulting in the tunnel structure and socket leaking. Signed-off-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/l2tp/l2tp_core.c')
-rw-r--r--net/l2tp/l2tp_core.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 50548c61b91e..e723828e458b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1564,10 +1564,12 @@ void l2tp_session_free(struct l2tp_session *session)
struct l2tp_tunnel *tunnel = session->tunnel;
if (tunnel) {
- BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+ if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
+ goto out;
l2tp_tunnel_dec_refcount(tunnel);
}
+out:
kfree(session);
}
EXPORT_SYMBOL_GPL(l2tp_session_free);