Patch "l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
l2tp-hold-tunnel-socket-when-handling-control-frames-in-l2tp_ip-and-l2tp_ip6.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Guillaume Nault <[email protected]>
Date: Wed, 29 Mar 2017 08:44:59 +0200
Subject: l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

From: Guillaume Nault <[email protected]>

[ Upstream commit 94d7ee0baa8b764cf64ad91ed69464c1a6a0066b ]

The code following l2tp_tunnel_find() expects that a new reference is held on sk. Either sk_receive_skb() or the discard_put error path will drop a reference from the tunnel's socket.

This issue exists in both l2tp_ip and l2tp_ip6.

---
 net/l2tp/l2tp_ip.c  |    5 +++--
 net/l2tp/l2tp_ip6.c |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

@@ -178,9 +178,10 @@ pass_up:
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
 	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (tunnel != NULL)
+	if (tunnel) {
 		sk = tunnel->sock;
-	else {
+		sock_hold(sk);
+	} else {
 		struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
 		read_lock_bh(&l2tp_ip_lock);

@@ -191,9 +191,10 @@ pass_up:
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
 	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (tunnel != NULL)
+	if (tunnel) {
 		sk = tunnel->sock;
-	else {
+		sock_hold(sk);
+	} else {
 		struct ipv6hdr *iph = ipv6_hdr(skb);
 
 		read_lock_bh(&l2tp_ip6_lock);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/l2tp-purge-socket-queues-in-the-.destruct-callback.patch queue-4.9/l2tp-hold-tunnel-socket-when-handling-control-frames-in-l2tp_ip-and-l2tp_ip6.patch queue-4.9/l2tp-take-reference-on-sessions-being-dumped.patch queue-4.9/l2tp-fix-ppp-pseudo-wire-auto-loading.patch