l2tp: fix refcount leak in l2tp_ip sockets
authorJames Chapman <jchapman@katalix.com>
Tue, 10 Apr 2012 00:10:42 +0000 (00:10 +0000)
committerDavid S. Miller <davem@davemloft.net>
Fri, 13 Apr 2012 15:01:44 +0000 (11:01 -0400)
The l2tp_ip socket close handler does not update the module refcount
correctly which prevents module unload after the first bind() call on
an L2TPv3 IP encapulation socket.

Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/l2tp/l2tp_ip.c

index 55670ec3cd0f916143759cbc73320cf85b7ef196..b56be1452f8ea1212b2b63fbd1580c861a1b90fc 100644 (file)
@@ -232,7 +232,7 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 {
        write_lock_bh(&l2tp_ip_lock);
        hlist_del_init(&sk->sk_bind_node);
-       hlist_del_init(&sk->sk_node);
+       sk_del_node_init(sk);
        write_unlock_bh(&l2tp_ip_lock);
        sk_common_release(sk);
 }