Commit 2b846c84 authored by Guillaume Nault's avatar Guillaume Nault Committed by Ben Hutchings

l2tp: take reference on sessions being dumped

commit e08293a4 upstream.

Take a reference on the sessions returned by l2tp_session_find_nth()
(and rename it l2tp_session_get_nth() to reflect this change), so that
caller is assured that the session isn't going to disappear while
processing it.

For procfs and debugfs handlers, the session is held in the .start()
callback and dropped in .show(). Given that pppol2tp_seq_session_show()
dereferences the associated PPPoL2TP socket and that
l2tp_dfs_seq_session_show() might call pppol2tp_show(), we also need to
call the session's .ref() callback to prevent the socket from going
away from under us.

Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Fixes: 0ad66140 ("l2tp: Add debugfs files for dumping l2tp debug info")
Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent dda727ef
...@@ -275,7 +275,8 @@ struct l2tp_session *l2tp_session_get(struct net *net, ...@@ -275,7 +275,8 @@ struct l2tp_session *l2tp_session_get(struct net *net,
} }
EXPORT_SYMBOL_GPL(l2tp_session_get); EXPORT_SYMBOL_GPL(l2tp_session_get);
struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
bool do_ref)
{ {
int hash; int hash;
struct hlist_node *walk; struct hlist_node *walk;
...@@ -286,6 +287,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) ...@@ -286,6 +287,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) { hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
if (++count > nth) { if (++count > nth) {
l2tp_session_inc_refcount(session);
if (do_ref && session->ref)
session->ref(session);
read_unlock_bh(&tunnel->hlist_lock); read_unlock_bh(&tunnel->hlist_lock);
return session; return session;
} }
...@@ -296,7 +300,7 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) ...@@ -296,7 +300,7 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
return NULL; return NULL;
} }
EXPORT_SYMBOL_GPL(l2tp_session_find_nth); EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
/* Lookup a session by interface name. /* Lookup a session by interface name.
* This is very inefficient but is only used by management interfaces. * This is very inefficient but is only used by management interfaces.
......
...@@ -226,7 +226,8 @@ struct l2tp_session *l2tp_session_get(struct net *net, ...@@ -226,7 +226,8 @@ struct l2tp_session *l2tp_session_get(struct net *net,
struct l2tp_tunnel *tunnel, struct l2tp_tunnel *tunnel,
u32 session_id, bool do_ref); u32 session_id, bool do_ref);
extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id); extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth); struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
bool do_ref);
struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname, struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
bool do_ref); bool do_ref);
extern struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id); extern struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
......
...@@ -51,7 +51,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd) ...@@ -51,7 +51,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd) static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
{ {
pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx); pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
pd->session_idx++; pd->session_idx++;
if (pd->session == NULL) { if (pd->session == NULL) {
...@@ -227,10 +227,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v) ...@@ -227,10 +227,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
} }
/* Show the tunnel or session context */ /* Show the tunnel or session context */
if (pd->session == NULL) if (!pd->session) {
l2tp_dfs_seq_tunnel_show(m, pd->tunnel); l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
else } else {
l2tp_dfs_seq_session_show(m, pd->session); l2tp_dfs_seq_session_show(m, pd->session);
if (pd->session->deref)
pd->session->deref(pd->session);
l2tp_session_dec_refcount(pd->session);
}
out: out:
return 0; return 0;
......
...@@ -669,7 +669,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback ...@@ -669,7 +669,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
goto out; goto out;
} }
session = l2tp_session_find_nth(tunnel, si); session = l2tp_session_get_nth(tunnel, si, false);
if (session == NULL) { if (session == NULL) {
ti++; ti++;
tunnel = NULL; tunnel = NULL;
...@@ -679,8 +679,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback ...@@ -679,8 +679,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).pid, if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).pid,
cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh->nlmsg_seq, NLM_F_MULTI,
session) <= 0) session) <= 0) {
l2tp_session_dec_refcount(session);
break; break;
}
l2tp_session_dec_refcount(session);
si++; si++;
} }
......
...@@ -1564,7 +1564,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) ...@@ -1564,7 +1564,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
{ {
pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx); pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
pd->session_idx++; pd->session_idx++;
if (pd->session == NULL) { if (pd->session == NULL) {
...@@ -1691,10 +1691,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v) ...@@ -1691,10 +1691,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
/* Show the tunnel or session context. /* Show the tunnel or session context.
*/ */
if (pd->session == NULL) if (!pd->session) {
pppol2tp_seq_tunnel_show(m, pd->tunnel); pppol2tp_seq_tunnel_show(m, pd->tunnel);
else } else {
pppol2tp_seq_session_show(m, pd->session); pppol2tp_seq_session_show(m, pd->session);
if (pd->session->deref)
pd->session->deref(pd->session);
l2tp_session_dec_refcount(pd->session);
}
out: out:
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment