[syzbot] [net?] KASAN: slab-use-after-free Write in l2tp_session_delete

Edward Adam Davis
2024-06-27T12:57:47Z

delete tunnl session list

#syz test: linux-next 185d72112b95

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 3596290047b2..1fd27c902d80 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -446,6 +446,7 @@ static int pppol2tp_release(struct socket *sock)
if (session) {
struct pppol2tp_session *ps;

+ list_del_init(&session->list);
l2tp_session_delete(session);

ps = l2tp_session_priv(session);