Guillaume Nault 3ae0fc9506 l2tp: purge socket queues in the .destruct() callback
[ Upstream commit e91793bb615cf6cdd59c0b6749fe173687bb0947 ]

The Rx path may grab the socket right before pppol2tp_release(), but
nothing guarantees that it will enqueue packets before
skb_queue_purge(). Therefore, the socket can be destroyed without its
queues fully purged.

Fix this by purging queues in pppol2tp_session_destruct() where we're
guaranteed nothing is still referencing the socket.

Fixes: 9e9cb6221aa7 ("l2tp: fix userspace reception on plain L2TP sockets")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-03 08:36:35 -07:00
..
2016-10-20 14:32:22 -04:00
2016-12-05 14:48:48 -05:00
2016-12-03 23:54:25 -05:00
2016-07-05 14:08:47 -07:00
2017-05-03 08:36:34 -07:00
2016-05-29 22:33:25 -07:00
2016-10-20 11:23:08 -04:00
2016-12-02 14:03:20 -05:00
2016-06-09 23:41:03 -07:00
2016-08-17 19:36:23 -04:00
2016-08-17 19:36:23 -04:00