Xiyu Yang 7e13a70dc7 net/l2tp: Fix reference count leak in l2tp_udp_recv_core ... commit 9b6ff7eb66 upstream. The reference count leak issue may take place in an error handling path. If both conditions of tunnel->version == L2TP_HDR_VER_3 and the return value of l2tp_v3_ensure_opt_in_linear is nonzero, the function would directly jump to label invalid, without decrementing the reference count of the l2tp_session object session increased earlier by l2tp_tunnel_get_session(). This may result in refcount leaks. Fix this issue by decrease the reference count before jumping to the label invalid. Fixes: 4522a70db7 ("l2tp: fix reading optional fields of L2TPv3") Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-09-22 11:45:33 +02:00
..
Kconfig
l2tp_core.c	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 11:45:33 +02:00
l2tp_core.h	l2tp: don't register sessions in l2tp_session_create()	2020-05-27 16:43:06 +02:00
l2tp_debugfs.c	l2tp: remove configurable payload offset	2018-11-04 14:52:43 +01:00
l2tp_eth.c	l2tp: initialise l2tp_eth sessions before registering them	2020-05-27 16:43:06 +02:00
l2tp_ip.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-11 09:22:59 +02:00
l2tp_ip6.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-11 09:22:59 +02:00
l2tp_netlink.c	l2tp: remove configurable payload offset	2018-11-04 14:52:43 +01:00
l2tp_ppp.c	l2tp: initialise PPP sessions before registering them	2020-05-27 16:43:07 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00