[PATCH net] l2tp: fix missing refcount drop in pppol2tp_tunnel_ioctl()

[Guillaume Nault]

If 'session' is not NULL and is not a PPP pseudo-wire, then we fail to
drop the reference taken by l2tp_session_get().

Fixes: ecd012e45ab5 ("l2tp: filter out non-PPP sessions in 
pppol2tp_tunnel_ioctl()")
Signed-off-by: Guillaume Nault <g.na...@alphalink.fr>
---
Sorry for the stupid mistake. I guess I got blinded by the apparent
simplicity of the bug when I wrote the original patch.

net/l2tp/l2tp_ppp.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index e398797878a9..cf6cca260e7b 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel 
*tunnel,
                                l2tp_session_get(sock_net(sk), tunnel,
                                                 stats.session_id);
 
-                       if (session && session->pwtype == L2TP_PWTYPE_PPP) {
-                               err = pppol2tp_session_ioctl(session, cmd,
-                                                            arg);
+                       if (!session) {
+                               err = -EBADR;
+                               break;
+                       }
+                       if (session->pwtype != L2TP_PWTYPE_PPP) {
                                l2tp_session_dec_refcount(session);
-                       } else {
                                err = -EBADR;
+                               break;
                        }
+
+                       err = pppol2tp_session_ioctl(session, cmd, arg);
+                       l2tp_session_dec_refcount(session);
                        break;
                }
 #ifdef CONFIG_XFRM
-- 
2.18.0