From: Sabrina Dubroca <s...@queasysnail.net> Date: Tue, 19 Sep 2017 15:40:40 +0200
> If we try to delete the same tunnel twice, the first delete operation > does a lookup (l2tp_tunnel_get), finds the tunnel, calls > l2tp_tunnel_delete, which queues it for deletion by > l2tp_tunnel_del_work. > > The second delete operation also finds the tunnel and calls > l2tp_tunnel_delete. If the workqueue has already fired and started > running l2tp_tunnel_del_work, then l2tp_tunnel_delete will queue the > same tunnel a second time, and try to free the socket again. > > Add a dead flag to prevent firing the workqueue twice. Then we can > remove the check of queue_work's result that was meant to prevent that > race but doesn't. > > Also check the flag in the tunnel lookup functions, to avoid returning a > tunnel that is already scheduled for destruction. Sabrina, please respond to Guillaume's feedback. Thank you.
