tree d8bbddb871da06b66202ebaf67527dcb3267f19b
parent 9267c430c6b6f4c0120e3c6bb847313d633f02a6
author Guillaume Nault <g.nault@alphalink.fr> 1523559033 +0200
committer David S. Miller <davem@davemloft.net> 1523636246 -0400

l2tp: hold reference on tunnels in netlink dumps

l2tp_tunnel_find_nth() is unsafe: no reference is held on the returned
tunnel, therefore it can be freed whenever the caller uses it.
This patch defines l2tp_tunnel_get_nth() which works similarly, but
also takes a reference on the returned tunnel. The caller then has to
drop it after it stops using the tunnel.

Convert netlink dumps to make them safe against concurrent tunnel
deletion.

Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>