linux/net/l2tp
Eric Dumazet e2e210c023 l2tp: fix race in l2tp_recv_dequeue()
Misha Labjuk reported panics occurring in l2tp_recv_dequeue()

If we release reorder_q.lock, we must not keep a dangling pointer (tmp),
since another thread could manipulate reorder_q.

Instead we must restart the scan at beginning of list.

Reported-by: Misha Labjuk <spiked.yar@gmail.com>
Tested-by: Misha Labjuk <spiked.yar@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-03 18:02:13 -04:00
..
Kconfig l2tp: Add debugfs files for dumping l2tp debug info 2010-04-03 14:56:07 -07:00
l2tp_core.c l2tp: fix race in l2tp_recv_dequeue() 2011-11-03 18:02:13 -04:00
l2tp_core.h l2tp: make local function static 2010-10-24 14:55:47 -07:00
l2tp_debugfs.c fix return values of l2tp_dfs_seq_open() 2011-06-05 14:11:09 -07:00
l2tp_eth.c net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared 2011-07-27 22:39:30 -07:00
l2tp_ip.c l2tp: fix l2tp_ip_sendmsg() route handling 2011-06-13 17:31:30 -04:00
l2tp_netlink.c l2tp: Fix set-but-unused variables. 2011-04-17 17:01:05 -07:00
l2tp_ppp.c l2tp: give proper headroom in pppol2tp_xmit() 2011-10-18 23:33:44 -04:00
Makefile l2tp: Add debugfs files for dumping l2tp debug info 2010-04-03 14:56:07 -07:00