diff mbox series

[net-next,v2,08/16] l2tp: hide session from pppol2tp_sock_to_session if it is closing

Message ID 1518430280-16671-9-git-send-email-jchapman@katalix.com
State Changes Requested, archived
Delegated to: David Miller
Headers show
Series l2tp: fix API races discovered by syzbot | expand

Commit Message

James Chapman Feb. 12, 2018, 10:11 a.m. UTC 
---
 net/l2tp/l2tp_ppp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ff95a4d4eac5..947066b3d6d8 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -172,8 +172,16 @@  static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
 		rcu_read_unlock_bh();
 		return NULL;
 	}
+
+	spin_lock_bh(&session->lock);
+	if (session->closing) {
+		spin_unlock_bh(&session->lock);
+		rcu_read_unlock_bh();
+		return NULL;
+	}
 	l2tp_session_inc_refcount(session);
-	rcu_read_unlock();
+	spin_unlock_bh(&session->lock);
+	rcu_read_unlock_bh();
 
 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);