l2tp: fix race in l2tp_recv_common()
authorGuillaume Nault <g.nault@alphalink.fr>
Fri, 31 Mar 2017 11:02:25 +0000 (13:02 +0200)
committerDavid S. Miller <davem@davemloft.net>
Sun, 2 Apr 2017 03:16:41 +0000 (20:16 -0700)
commit61b9a047729bb230978178bca6729689d0c50ca2
treef8dfc3ba7bfc78123ad285d0b846c8b7c865129c
parentafe89962ee0799955b606cc7637ac86a296923a6
l2tp: fix race in l2tp_recv_common()

Taking a reference on sessions in l2tp_recv_common() is racy; this
has to be done by the callers.

To this end, a new function is required (l2tp_session_get()) to
atomically lookup a session and take a reference on it. Callers then
have to manually drop this reference.

Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/l2tp/l2tp_core.c
net/l2tp/l2tp_core.h
net/l2tp/l2tp_ip.c
net/l2tp/l2tp_ip6.c