l2tp: protect tunnel->del_work by ref_count
authorAlexander Couzens <lynxis@fe80.eu>
Mon, 28 Sep 2015 09:32:42 +0000 (11:32 +0200)
committerDavid S. Miller <davem@davemloft.net>
Tue, 29 Sep 2015 05:39:10 +0000 (22:39 -0700)
commit06a15f51cf3618e32a73871ee6a547ef7fd902b5
tree5d7f25db11b5b985c7366d8bf954aeca976f2b2b
parent661dfc65f7981481ba2e31aaa702371e82336e56
l2tp: protect tunnel->del_work by ref_count

There is a small chance that tunnel_free() is called before tunnel->del_work scheduled
resulting in a zero pointer dereference.

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Acked-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/l2tp/l2tp_core.c