--- net/l2tp/l2tp_ppp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index ff95a4d4eac5..947066b3d6d8 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -172,8 +172,16 @@ static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) rcu_read_unlock_bh(); return NULL; } + + spin_lock_bh(&session->lock); + if (session->closing) { + spin_unlock_bh(&session->lock); + rcu_read_unlock_bh(); + return NULL; + } l2tp_session_inc_refcount(session); - rcu_read_unlock(); + spin_unlock_bh(&session->lock); + rcu_read_unlock_bh(); BUG_ON(session->magic != L2TP_SESSION_MAGIC); -- 1.9.1