This is a note to let you know that I've just added the patch titled
l2tp: fix oops in l2tp_eth_create() error path
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
l2tp-fix-oops-in-l2tp_eth_create-error-path.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 24d9d3f94bccfb3ee9eb85260d34033e3e2d247d Mon Sep 17 00:00:00 2001
From: Tom Parkin <[email protected]>
Date: Mon, 29 Oct 2012 23:41:48 +0000
Subject: l2tp: fix oops in l2tp_eth_create() error path
From: Tom Parkin <[email protected]>
[ Upstream commit 789336360e0a2aeb9750c16ab704a02cbe035e9e ]
When creating an L2TPv3 Ethernet session, if register_netdev() should fail for
any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the
32k-interface limit), the netdev is freed in the error path. However, the
l2tp_eth_sess structure's dev pointer is left uncleared, and this results in
l2tp_eth_delete() then attempting to unregister the same netdev later in the
session teardown. This results in an oops.
To avoid this, clear the session dev pointer in the error path.
Signed-off-by: Tom Parkin <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/l2tp/l2tp_eth.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -269,6 +269,7 @@ static int l2tp_eth_create(struct net *n
out_del_dev:
free_netdev(dev);
+ spriv->dev = NULL;
out_del_session:
l2tp_session_delete(session);
out:
Patches currently in stable-queue which might be from [email protected] are
queue-3.4/l2tp-fix-oops-in-l2tp_eth_create-error-path.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
