l2tp: close sessions in ip socket destroy callback

l2tp_core hooks UDP's .destroy handler to gain advance warning of a tunnel
socket being closed from userspace.  We need to do the same thing for
IP-encapsulation sockets.

Signed-off-by: Tom Parkin <tparkin@katalix.com>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 13 insertions, 0 deletions

diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 7f41b7051269..571db8dd2292 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -228,10 +228,16 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 static void l2tp_ip_destroy_sock(struct sock *sk)
 {
         struct sk_buff *skb;
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
                 kfree_skb(skb);
 
+        if (tunnel) {
+                l2tp_tunnel_closeall(tunnel);
+                sock_put(sk);
+        }
+
         sk_refcnt_debug_dec(sk);
 }
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 41f2f8126ebc..c74f5a91ff6a 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -241,10 +241,17 @@ static void l2tp_ip6_close(struct sock *sk, long timeout)
 
 static void l2tp_ip6_destroy_sock(struct sock *sk)
 {
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+
         lock_sock(sk);
         ip6_flush_pending_frames(sk);
         release_sock(sk);
 
+        if (tunnel) {
+                l2tp_tunnel_closeall(tunnel);
+                sock_put(sk);
+        }
+
         inet6_destroy_sock(sk);
 }