Patchwork [3.5.y.z,extended,stable] Patch "l2tp: fix oops in l2tp_eth_create() error path" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Dec. 12, 2012, 5:11 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/205413/
State New
Headers show


Herton Ronaldo Krzesinski - Dec. 12, 2012, 5:11 a.m.
This is a note to let you know that I have just added a patch titled

    l2tp: fix oops in l2tp_eth_create() error path

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 2a08dea2f2ff16f595243142ea6a7d66403ddbfe Mon Sep 17 00:00:00 2001
From: Tom Parkin <>
Date: Mon, 29 Oct 2012 23:41:48 +0000
Subject: [PATCH] l2tp: fix oops in l2tp_eth_create() error path

commit 789336360e0a2aeb9750c16ab704a02cbe035e9e upstream.

When creating an L2TPv3 Ethernet session, if register_netdev() should fail for
any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the
32k-interface limit), the netdev is freed in the error path.  However, the
l2tp_eth_sess structure's dev pointer is left uncleared, and this results in
l2tp_eth_delete() then attempting to unregister the same netdev later in the
session teardown.  This results in an oops.

To avoid this, clear the session dev pointer in the error path.

Signed-off-by: Tom Parkin <>
Signed-off-by: David S. Miller <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 net/l2tp/l2tp_eth.c |    1 +
 1 file changed, 1 insertion(+)



diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 94840d8..80196f3 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -285,6 +285,7 @@  static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p

+	spriv->dev = NULL;