From: Guillaume Nault
Date: Fri, 3 Nov 2017 16:49:00 +0100
> Using l2tp_tunnel_find() in l2tp_ip_recv() is wrong for two reasons:
>
> * It doesn't take a reference on the returned tunnel, which makes the
> call racy wrt. concurrent tunnel deletion.
>
> * The lookup is only based on the
Using l2tp_tunnel_find() in l2tp_ip_recv() is wrong for two reasons:
* It doesn't take a reference on the returned tunnel, which makes the
call racy wrt. concurrent tunnel deletion.
* The lookup is only based on the tunnel identifier, so it can return
a tunnel that doesn't match the p
