From: Eric Dumazet
Date: Tue, 30 Apr 2019 06:27:58 -0700
> Before taking a refcount on a rcu protected structure,
> we need to make sure the refcount is not zero.
>
> syzbot reported :
...
> Fixes: 54652eb12c1b ("l2tp: hold tunnel while looking up sessions in
> l2tp_netlink")
> Signed-off-by:
Before taking a refcount on a rcu protected structure,
we need to make sure the refcount is not zero.
syzbot reported :
refcount_t: increment on 0; use-after-free.
WARNING: CPU: 1 PID: 23533 at lib/refcount.c:156 refcount_inc_checked
lib/refcount.c:156 [inline]
WARNING: CPU: 1 PID: 23533 at lib/
