From patchwork Wed Jan 9 18:36:23 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Parkin X-Patchwork-Id: 210815 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1B1F32C0090 for ; Thu, 10 Jan 2013 05:36:57 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758028Ab3AISgt (ORCPT ); Wed, 9 Jan 2013 13:36:49 -0500 Received: from katalix.com ([82.103.140.233]:55331 "EHLO mail.katalix.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932234Ab3AISgs (ORCPT ); Wed, 9 Jan 2013 13:36:48 -0500 Received: from raven.tomandflo.local (cpc28-brad20-2-0-cust174.17-1.cable.virginmedia.com [77.97.157.175]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: tom) by mail.katalix.com (Postfix) with ESMTPSA id 1E91AA6211B; Wed, 9 Jan 2013 18:36:45 +0000 (GMT) From: Tom Parkin To: netdev@vger.kernel.org Cc: Tom Parkin , James Chapman Subject: [PATCH 4/4] l2tp: clear tunnel socket field as soon as we release it Date: Wed, 9 Jan 2013 18:36:23 +0000 Message-Id: <1357756583-22535-5-git-send-email-tparkin@katalix.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1357756583-22535-1-git-send-email-tparkin@katalix.com> References: <1357756583-22535-1-git-send-email-tparkin@katalix.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org L2TP's struct l2tp_tunnel is freed and removed from the tunnel list by the socket destructor, which may or may not run when we release our reference to the socket in l2tp_tunnel_delete. To prevent any chance of accidentally reusing the socket after it is released, clear out the field in l2tp_tunnel_delete. Signed-off-by: Tom Parkin Signed-off-by: James Chapman --- net/l2tp/l2tp_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 5922eac..0cfc701 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1668,6 +1668,7 @@ int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) * sessions are removed via. the socket destructor. */ if (sock != NULL) { + tunnel->sock = NULL; if (sock->file == NULL) { kernel_sock_shutdown(sock, SHUT_RDWR); sk_release_kernel(sock->sk);