• Guillaume Nault's avatar
    l2tp: ensure sessions are freed after their PPPOL2TP socket · cdd10c96
    Guillaume Nault authored
    If l2tp_tunnel_delete() or l2tp_tunnel_closeall() deletes a session
    right after pppol2tp_release() orphaned its socket, then the 'sock'
    variable of the pppol2tp_session_close() callback is NULL. Yet the
    session is still used by pppol2tp_release().
    
    Therefore we need to take an extra reference in any case, to prevent
    l2tp_tunnel_delete() or l2tp_tunnel_closeall() from freeing the session.
    
    Since the pppol2tp_session_close() callback is only set if the session
    is associated to a PPPOL2TP socket and that both l2tp_tunnel_delete()
    and l2tp_tunnel_closeall() hold the PPPOL2TP socket before calling
    pppol2tp_session_close(), we're sure that pppol2tp_session_close() and
    pppol2tp_session_destruct() are paired and called in the right order.
    So the reference taken by the former will be released by the later.
    Signed-off-by: 's avatarGuillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    cdd10c96
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
l2tp_core.c Loading commit data...
l2tp_core.h Loading commit data...
l2tp_debugfs.c Loading commit data...
l2tp_eth.c Loading commit data...
l2tp_ip.c Loading commit data...
l2tp_ip6.c Loading commit data...
l2tp_netlink.c Loading commit data...
l2tp_ppp.c Loading commit data...