tree a86fb8a4b62c49d268ac0ece79eae9c22bac0e58
parent 4c15cdb962d27d5b095fd444156c0746993df377
author Guillaume Nault <g.nault@alphalink.fr> 1590104370 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1590590517 +0200

l2tp: hold tunnel used while creating sessions with netlink

commit e702c1204eb57788ef189c839c8c779368267d70 upstream.

Use l2tp_tunnel_get() to retrieve tunnel, so that it can't go away on
us. Otherwise l2tp_tunnel_destruct() might release the last reference
count concurrently, thus freeing the tunnel while we're using it.

Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Giuliano Procida <gprocida@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>