Commit 493048f5 authored Jul 24, 2020 by Tom Parkin Committed by David S. Miller Jul 24, 2020

l2tp: WARN_ON rather than BUG_ON in l2tp_session_queue_purge

l2tp_session_queue_purge is used during session shutdown to drop any
skbs queued for reordering purposes according to L2TP dataplane rules.

The BUG_ON in this function checks the session magic feather in an
attempt to catch lifetime bugs.

Rather than crashing the kernel with a BUG_ON, we can simply WARN_ON and
refuse to do anything more -- in the worst case this could result in a
leak. However this is highly unlikely given that the session purge only
occurs from codepaths which have obtained the session by means of a lookup
via. the parent tunnel and which check the session "dead" flag to
protect against shutdown races.

While we're here, have l2tp_session_queue_purge return void rather than
an integer, since neither of the callsites checked the return value.

Signed-off-by: Tom Parkin <tparkin@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ebb4f5e6

net/l2tp/l2tp_core.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -773,16 +773,17 @@ EXPORT_SYMBOL(l2tp_recv_common);

		/* Drop skbs from the session's reorder_q
		*/
		static int l2tp_session_queue_purge(struct l2tp_session *session)
		static void l2tp_session_queue_purge(struct l2tp_session *session)
		{
		struct sk_buff *skb = NULL;

		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
		if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
		return;

		while ((skb = skb_dequeue(&session->reorder_q))) {
		atomic_long_inc(&session->stats.rx_errors);
		kfree_skb(skb);
		}
		return 0;
		}

		/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame

Admin message