[PATCH] l2tp: fix tunnel refcount leak on register failure

[Wentao Liang]

pppol2tp_tunnel_get() creates a new tunnel via l2tp_tunnel_create()
which initializes tunnel->ref_count to 1, then increments it to 2 via
refcount_inc(). If l2tp_tunnel_register() subsequently fails, the
error path calls kfree(tunnel) directly, bypassing the refcount
mechanism entirely. This leaves the tunnel's ref_count at 2 with no
way to properly release it through l2tp_tunnel_put().

Replace kfree(tunnel) with l2tp_tunnel_put(tunnel) to properly release
the reference through the standard refcount cleanup path, which will
call l2tp_tunnel_free() when the counter reaches zero.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 net/l2tp/l2tp_ppp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 99d6582f41de..16672e9df748 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -661,7 +661,7 @@ static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
 			refcount_inc(&tunnel->ref_count);
 			error = l2tp_tunnel_register(tunnel, net, &tcfg);
 			if (error < 0) {
-				kfree(tunnel);
+				l2tp_tunnel_put(tunnel);
 				return ERR_PTR(error);
 			}
 
-- 
2.34.1