l2tp: purge socket queues in the .destruct() callback
authorGuillaume Nault <g.nault@alphalink.fr>
Wed, 29 Mar 2017 06:45:29 +0000 (08:45 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 29 Mar 2017 16:26:28 +0000 (09:26 -0700)
commite91793bb615cf6cdd59c0b6749fe173687bb0947
tree9c97fe223f9e484f08928289635c9e9e09c43ab9
parent94d7ee0baa8b764cf64ad91ed69464c1a6a0066b
l2tp: purge socket queues in the .destruct() callback

The Rx path may grab the socket right before pppol2tp_release(), but
nothing guarantees that it will enqueue packets before
skb_queue_purge(). Therefore, the socket can be destroyed without its
queues fully purged.

Fix this by purging queues in pppol2tp_session_destruct() where we're
guaranteed nothing is still referencing the socket.

Fixes: 9e9cb6221aa7 ("l2tp: fix userspace reception on plain L2TP sockets")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/l2tp/l2tp_ppp.c