Eric Dumazet e2e210c023 l2tp: fix race in l2tp_recv_dequeue() ...

Misha Labjuk reported panics occurring in l2tp_recv_dequeue()

If we release reorder_q.lock, we must not keep a dangling pointer (tmp),
since another thread could manipulate reorder_q.

Instead we must restart the scan at beginning of list.

Reported-by: Misha Labjuk <spiked.yar@gmail.com>
Tested-by: Misha Labjuk <spiked.yar@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2011-11-03 18:02:13 -04:00

..

Kconfig

l2tp: Add debugfs files for dumping l2tp debug info

2010-04-03 14:56:07 -07:00

l2tp_core.c

l2tp: fix race in l2tp_recv_dequeue()

2011-11-03 18:02:13 -04:00

l2tp_core.h

l2tp: make local function static

2010-10-24 14:55:47 -07:00

l2tp_debugfs.c

fix return values of l2tp_dfs_seq_open()

2011-06-05 14:11:09 -07:00

l2tp_eth.c

net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

2011-07-27 22:39:30 -07:00

l2tp_ip.c

l2tp: fix l2tp_ip_sendmsg() route handling

2011-06-13 17:31:30 -04:00

l2tp_netlink.c

l2tp: Fix set-but-unused variables.

2011-04-17 17:01:05 -07:00

l2tp_ppp.c

l2tp: give proper headroom in pppol2tp_xmit()

2011-10-18 23:33:44 -04:00

Makefile

l2tp: Add debugfs files for dumping l2tp debug info

2010-04-03 14:56:07 -07:00