Guillaume Nault 80ab1e24e2 l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 ... commit 94d7ee0baa upstream. The code following l2tp_tunnel_find() expects that a new reference is held on sk. Either sk_receive_skb() or the discard_put error path will drop a reference from the tunnel's socket. This issue exists in both l2tp_ip and l2tp_ip6. Fixes: a3c18422a4 ("l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()") Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-10 07:41:43 -08:00
..
Kconfig	l2tp: Call udp_sock_create	2014-07-14 16:12:15 -07:00
l2tp_core.c	l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache	2018-08-22 07:48:35 +02:00
l2tp_core.h	l2tp: fix race condition in l2tp_tunnel_delete	2017-10-21 17:09:03 +02:00
l2tp_debugfs.c	l2tp: take reference on sessions being dumped	2017-05-02 21:19:52 -07:00
l2tp_eth.c	l2tp: auto load type modules	2015-09-25 12:27:22 -07:00
l2tp_ip.c	l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6	2018-11-10 07:41:43 -08:00
l2tp_ip6.c	l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6	2018-11-10 07:41:43 -08:00
l2tp_netlink.c	l2tp: revert "l2tp: fix missing print session offset info"	2018-05-26 08:48:50 +02:00
l2tp_ppp.c	l2tp: check sockaddr length in pppol2tp_connect()	2018-04-29 07:50:04 +02:00
Makefile	l2tp: introduce L2TPv3 IP encapsulation support for IPv6	2012-05-01 09:30:55 -04:00