l2tp: clean up stale tunnel or session in pppol2tp_connect's error path

pppol2tp_connect() may create a tunnel or a session. Remove them in
case of error.

Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1b24f76ae210e2f89d791aa96c2d60da091c6520..f429fed06a1e7afb00fdf0331aac8a25821b5810 100644 (file)
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -612,6 +612,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        u32 session_id, peer_session_id;
        bool drop_refcnt = false;
        bool drop_tunnel = false;
+       bool new_session = false;
+       bool new_tunnel = false;
        int ver = 2;
        int fd;
 
@@ -722,6 +724,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                                goto end;
                        }
                        drop_tunnel = true;
+                       new_tunnel = true;
                }
        } else {
                /* Error if we can't find the tunnel */
@@ -788,6 +791,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                        goto end;
                }
                drop_refcnt = true;
+               new_session = true;
        }
 
        /* Special case: if source & dest session_id == 0x0000, this
@@ -834,6 +838,12 @@ out_no_ppp:
                  session->name);
 
 end:
+       if (error) {
+               if (new_session)
+                       l2tp_session_delete(session);
+               if (new_tunnel)
+                       l2tp_tunnel_delete(tunnel);
+       }
        if (drop_refcnt)
                l2tp_session_dec_refcount(session);
        if (drop_tunnel)