l2tp: initialise session's refcount before making it reachable
commit 9ee369a405c57613d7c83a3967780c3e30c52ecc upstream.
Sessions must be fully initialised before calling
l2tp_session_add_to_tunnel(). Otherwise, there's a short time frame
where partially initialised sessions can be accessed by external users.
l2tp_core.c: moving code that had been converted from atomic to
refcount_t by an earlier change (which isn't being included in this
Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation")
Signed-off-by: Guillaume Nault <firstname.lastname@example.org>
Signed-off-by: David S. Miller <email@example.com>
Signed-off-by: Giuliano Procida <firstname.lastname@example.org>
Signed-off-by: Greg Kroah-Hartman <email@example.com>
1 file changed