Guillaume Nault e8e56ffd9d ppp: ensure file->private_data can't be overridden
Locking ppp_mutex must be done before dereferencing file->private_data,
otherwise it could be modified before ppp_unattached_ioctl() takes the
lock. This could lead ppp_unattached_ioctl() to override ->private_data,
thus leaking reference to the ppp_file previously pointed to.

v2: lock all ppp_ioctl() instead of just checking private_data in
    ppp_unattached_ioctl(), to avoid ambiguous behaviour.

Fixes: f3ff8a4d80e8 ("ppp: push BKL down into the driver")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-03-16 19:35:06 -04:00
..
2015-12-29 15:32:24 -05:00
2016-01-01 18:31:34 +01:00
2015-12-21 11:44:00 +09:00
2016-01-20 17:30:20 -08:00
2016-01-13 10:23:36 -08:00
2016-01-12 12:17:28 +01:00
2016-01-20 18:42:30 -08:00
2016-02-23 17:17:20 -08:00
2016-03-14 15:31:58 -04:00
2016-01-22 18:04:28 -05:00
2016-01-20 17:09:18 -08:00
2016-01-03 16:32:59 -08:00
2016-03-03 12:54:39 -08:00
2016-01-12 01:12:40 +01:00
2016-01-20 17:09:18 -08:00
2016-01-15 12:14:47 -08:00
2016-01-18 12:10:45 -08:00
2016-02-17 09:24:07 +01:00
2016-02-26 12:47:32 +02:00
2016-03-03 12:37:21 -08:00
2016-02-28 07:38:52 -07:00
2016-02-22 13:57:01 -08:00