Merge branch 'l2tp-fix-some-races-in-session-deletion' (016576d5) · Commits · 戴 / test

net/l2tp/l2tp_core.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1314,6 +1314,9 @@ again:

		hlist_del_init(&session->hlist);

		if (test_and_set_bit(0, &session->dead))
		goto again;

		if (session->ref != NULL)
		(*session->ref)(session);

		@@ -1750,6 +1753,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
		*/
		int l2tp_session_delete(struct l2tp_session *session)
		{
		if (test_and_set_bit(0, &session->dead))
		return 0;

		if (session->ref)
		(*session->ref)(session);
		__l2tp_session_unhash(session);

+1 −0

Original line number	Diff line number	Diff line
		@@ -76,6 +76,7 @@ struct l2tp_session_cfg {
		struct l2tp_session {
		int magic; /* should be
		* L2TP_SESSION_MAGIC */
		long dead;

		struct l2tp_tunnel tunnel; / back pointer to tunnel
		* context */

+4 −4

Original line number	Diff line number	Diff line
		@@ -437,12 +437,12 @@ static void pppol2tp_session_close(struct l2tp_session *session)

		BUG_ON(session->magic != L2TP_SESSION_MAGIC);

		if (sock) {
		if (sock)
		inet_shutdown(sock, SEND_SHUTDOWN);

		/* Don't let the session go away before our socket does */
		l2tp_session_inc_refcount(session);
		}
		}

		/* Really kill the session socket. (Called from sock_put() if
		* refcnt == 0.)