Patch "l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6" has been added to the 4.9-stable tree

Patch "l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     l2tp-hold-tunnel-socket-when-handling-control-frames-in-l2tp_ip-and-l2tp_ip6.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Sat Apr 29 08:22:13 CEST 2017
From: Guillaume Nault <g.nault@alphalink.fr>
Date: Wed, 29 Mar 2017 08:44:59 +0200
Subject: l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

From: Guillaume Nault <g.nault@alphalink.fr>


[ Upstream commit 94d7ee0baa8b764cf64ad91ed69464c1a6a0066b ]

The code following l2tp_tunnel_find() expects that a new reference is
held on sk. Either sk_receive_skb() or the discard_put error path will
drop a reference from the tunnel's socket.

This issue exists in both l2tp_ip and l2tp_ip6.

Fixes: a3c18422a4b4 ("l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_ip.c  |    5 +++--
 net/l2tp/l2tp_ip6.c |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -178,9 +178,10 @@ pass_up:
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
 	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (tunnel != NULL)
+	if (tunnel) {
 		sk = tunnel->sock;
-	else {
+		sock_hold(sk);
+	} else {
 		struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
 		read_lock_bh(&l2tp_ip_lock);
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -191,9 +191,10 @@ pass_up:
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
 	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (tunnel != NULL)
+	if (tunnel) {
 		sk = tunnel->sock;
-	else {
+		sock_hold(sk);
+	} else {
 		struct ipv6hdr *iph = ipv6_hdr(skb);
 
 		read_lock_bh(&l2tp_ip6_lock);


Patches currently in stable-queue which might be from g.nault@alphalink.fr are

queue-4.9/l2tp-purge-socket-queues-in-the-.destruct-callback.patch
queue-4.9/l2tp-hold-tunnel-socket-when-handling-control-frames-in-l2tp_ip-and-l2tp_ip6.patch
queue-4.9/l2tp-take-reference-on-sessions-being-dumped.patch
queue-4.9/l2tp-fix-ppp-pseudo-wire-auto-loading.patch