]> git.hungrycats.org Git - linux/commit
l2tp: protect tunnel->del_work by ref_count
authorAlexander Couzens <lynxis@fe80.eu>
Mon, 28 Sep 2015 09:32:42 +0000 (11:32 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 27 Oct 2015 00:53:35 +0000 (09:53 +0900)
commite23ef3bd21ee4aedf7ee257e5bca7d2f128713ca
tree1658fce9030e32586c0ec1fc43c919c5ed9c01b8
parentd034161050e87180a3f97e53ced881dc30d20cca
l2tp: protect tunnel->del_work by ref_count

[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ]

There is a small chance that tunnel_free() is called before tunnel->del_work scheduled
resulting in a zero pointer dereference.

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Acked-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/l2tp/l2tp_core.c