Merge tag 'media/v4.15-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mcheh...
[linux-2.6-block.git] / net / l2tp / l2tp_ppp.c
index 0c2738349442ba705f4240aed29fc4c1d9be727d..b412fc3351dc38fe00de6d86b3dc8b960da25699 100644 (file)
 struct pppol2tp_session {
        int                     owner;          /* pid that opened the socket */
 
-       struct sock             *sock;          /* Pointer to the session
+       struct mutex            sk_lock;        /* Protects .sk */
+       struct sock __rcu       *sk;            /* Pointer to the session
                                                 * PPPoX socket */
-       struct sock             *tunnel_sock;   /* Pointer to the tunnel UDP
-                                                * socket */
+       struct sock             *__sk;          /* Copy of .sk, for cleanup */
+       struct rcu_head         rcu;            /* For asynchronous release */
        int                     flags;          /* accessed by PPPIOCGFLAGS.
                                                 * Unused. */
 };
@@ -138,6 +139,24 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = {
 
 static const struct proto_ops pppol2tp_ops;
 
+/* Retrieves the pppol2tp socket associated to a session.
+ * A reference is held on the returned socket, so this function must be paired
+ * with sock_put().
+ */
+static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
+{
+       struct pppol2tp_session *ps = l2tp_session_priv(session);
+       struct sock *sk;
+
+       rcu_read_lock();
+       sk = rcu_dereference(ps->sk);
+       if (sk)
+               sock_hold(sk);
+       rcu_read_unlock();
+
+       return sk;
+}
+
 /* Helpers to obtain tunnel/session contexts from sockets.
  */
 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
@@ -224,7 +243,8 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
        /* If the socket is bound, send it in to PPP's input queue. Otherwise
         * queue it on the session socket.
         */
-       sk = ps->sock;
+       rcu_read_lock();
+       sk = rcu_dereference(ps->sk);
        if (sk == NULL)
                goto no_sock;
 
@@ -247,30 +267,16 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                        kfree_skb(skb);
                }
        }
+       rcu_read_unlock();
 
        return;
 
 no_sock:
+       rcu_read_unlock();
        l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
        kfree_skb(skb);
 }
 
-static void pppol2tp_session_sock_hold(struct l2tp_session *session)
-{
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
-
-       if (ps->sock)
-               sock_hold(ps->sock);
-}
-
-static void pppol2tp_session_sock_put(struct l2tp_session *session)
-{
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
-
-       if (ps->sock)
-               sock_put(ps->sock);
-}
-
 /************************************************************************
  * Transmit handling
  ***********************************************************************/
@@ -287,7 +293,6 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
        int error;
        struct l2tp_session *session;
        struct l2tp_tunnel *tunnel;
-       struct pppol2tp_session *ps;
        int uhlen;
 
        error = -ENOTCONN;
@@ -300,10 +305,7 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
        if (session == NULL)
                goto error;
 
-       ps = l2tp_session_priv(session);
-       tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-       if (tunnel == NULL)
-               goto error_put_sess;
+       tunnel = session->tunnel;
 
        uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 
@@ -314,7 +316,7 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
                           2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
                           0, GFP_KERNEL);
        if (!skb)
-               goto error_put_sess_tun;
+               goto error_put_sess;
 
        /* Reserve space for headers. */
        skb_reserve(skb, NET_SKB_PAD);
@@ -332,20 +334,17 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
        error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
        if (error < 0) {
                kfree_skb(skb);
-               goto error_put_sess_tun;
+               goto error_put_sess;
        }
 
        local_bh_disable();
        l2tp_xmit_skb(session, skb, session->hdr_len);
        local_bh_enable();
 
-       sock_put(ps->tunnel_sock);
        sock_put(sk);
 
        return total_len;
 
-error_put_sess_tun:
-       sock_put(ps->tunnel_sock);
 error_put_sess:
        sock_put(sk);
 error:
@@ -369,10 +368,8 @@ error:
 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 {
        struct sock *sk = (struct sock *) chan->private;
-       struct sock *sk_tun;
        struct l2tp_session *session;
        struct l2tp_tunnel *tunnel;
-       struct pppol2tp_session *ps;
        int uhlen, headroom;
 
        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -383,13 +380,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        if (session == NULL)
                goto abort;
 
-       ps = l2tp_session_priv(session);
-       sk_tun = ps->tunnel_sock;
-       if (sk_tun == NULL)
-               goto abort_put_sess;
-       tunnel = l2tp_sock_to_tunnel(sk_tun);
-       if (tunnel == NULL)
-               goto abort_put_sess;
+       tunnel = session->tunnel;
 
        uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
        headroom = NET_SKB_PAD +
@@ -398,7 +389,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                   session->hdr_len +   /* L2TP header */
                   2;                   /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
        if (skb_cow_head(skb, headroom))
-               goto abort_put_sess_tun;
+               goto abort_put_sess;
 
        /* Setup PPP header */
        __skb_push(skb, 2);
@@ -409,12 +400,10 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        l2tp_xmit_skb(session, skb, session->hdr_len);
        local_bh_enable();
 
-       sock_put(sk_tun);
        sock_put(sk);
+
        return 1;
 
-abort_put_sess_tun:
-       sock_put(sk_tun);
 abort_put_sess:
        sock_put(sk);
 abort:
@@ -431,17 +420,16 @@ abort:
  */
 static void pppol2tp_session_close(struct l2tp_session *session)
 {
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
-       struct sock *sk = ps->sock;
-       struct socket *sock = sk->sk_socket;
+       struct sock *sk;
 
        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-       if (sock)
-               inet_shutdown(sock, SEND_SHUTDOWN);
-
-       /* Don't let the session go away before our socket does */
-       l2tp_session_inc_refcount(session);
+       sk = pppol2tp_session_get_sock(session);
+       if (sk) {
+               if (sk->sk_socket)
+                       inet_shutdown(sk->sk_socket, SEND_SHUTDOWN);
+               sock_put(sk);
+       }
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -461,6 +449,14 @@ static void pppol2tp_session_destruct(struct sock *sk)
        }
 }
 
+static void pppol2tp_put_sk(struct rcu_head *head)
+{
+       struct pppol2tp_session *ps;
+
+       ps = container_of(head, typeof(*ps), rcu);
+       sock_put(ps->__sk);
+}
+
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
@@ -486,11 +482,23 @@ static int pppol2tp_release(struct socket *sock)
 
        session = pppol2tp_sock_to_session(sk);
 
-       /* Purge any queued data */
        if (session != NULL) {
-               __l2tp_session_unhash(session);
-               l2tp_session_queue_purge(session);
-               sock_put(sk);
+               struct pppol2tp_session *ps;
+
+               l2tp_session_delete(session);
+
+               ps = l2tp_session_priv(session);
+               mutex_lock(&ps->sk_lock);
+               ps->__sk = rcu_dereference_protected(ps->sk,
+                                                    lockdep_is_held(&ps->sk_lock));
+               RCU_INIT_POINTER(ps->sk, NULL);
+               mutex_unlock(&ps->sk_lock);
+               call_rcu(&ps->rcu, pppol2tp_put_sk);
+
+               /* Rely on the sock_put() call at the end of the function for
+                * dropping the reference held by pppol2tp_sock_to_session().
+                * The last reference will be dropped by pppol2tp_put_sk().
+                */
        }
        release_sock(sk);
 
@@ -557,16 +565,46 @@ out:
 static void pppol2tp_show(struct seq_file *m, void *arg)
 {
        struct l2tp_session *session = arg;
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
+       struct sock *sk;
 
-       if (ps) {
-               struct pppox_sock *po = pppox_sk(ps->sock);
-               if (po)
-                       seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+       sk = pppol2tp_session_get_sock(session);
+       if (sk) {
+               struct pppox_sock *po = pppox_sk(sk);
+
+               seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+               sock_put(sk);
        }
 }
 #endif
 
+static void pppol2tp_session_init(struct l2tp_session *session)
+{
+       struct pppol2tp_session *ps;
+       struct dst_entry *dst;
+
+       session->recv_skb = pppol2tp_recv;
+       session->session_close = pppol2tp_session_close;
+#if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
+       session->show = pppol2tp_show;
+#endif
+
+       ps = l2tp_session_priv(session);
+       mutex_init(&ps->sk_lock);
+       ps->owner = current->pid;
+
+       /* If PMTU discovery was enabled, use the MTU that was discovered */
+       dst = sk_dst_get(session->tunnel->sock);
+       if (dst) {
+               u32 pmtu = dst_mtu(dst);
+
+               if (pmtu) {
+                       session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD;
+                       session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD;
+               }
+               dst_release(dst);
+       }
+}
+
 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
  */
 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
@@ -578,7 +616,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        struct l2tp_session *session = NULL;
        struct l2tp_tunnel *tunnel;
        struct pppol2tp_session *ps;
-       struct dst_entry *dst;
        struct l2tp_session_cfg cfg = { 0, };
        int error = 0;
        u32 tunnel_id, peer_tunnel_id;
@@ -688,7 +725,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        if (tunnel->peer_tunnel_id == 0)
                tunnel->peer_tunnel_id = peer_tunnel_id;
 
-       session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
+       session = l2tp_session_get(sock_net(sk), tunnel, session_id);
        if (session) {
                drop_refcnt = true;
                ps = l2tp_session_priv(session);
@@ -696,13 +733,10 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                /* Using a pre-existing session is fine as long as it hasn't
                 * been connected yet.
                 */
-               if (ps->sock) {
-                       error = -EEXIST;
-                       goto end;
-               }
-
-               /* consistency checks */
-               if (ps->tunnel_sock != tunnel->sock) {
+               mutex_lock(&ps->sk_lock);
+               if (rcu_dereference_protected(ps->sk,
+                                             lockdep_is_held(&ps->sk_lock))) {
+                       mutex_unlock(&ps->sk_lock);
                        error = -EEXIST;
                        goto end;
                }
@@ -718,35 +752,19 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                        error = PTR_ERR(session);
                        goto end;
                }
-       }
-
-       /* Associate session with its PPPoL2TP socket */
-       ps = l2tp_session_priv(session);
-       ps->owner            = current->pid;
-       ps->sock             = sk;
-       ps->tunnel_sock = tunnel->sock;
 
-       session->recv_skb       = pppol2tp_recv;
-       session->session_close  = pppol2tp_session_close;
-#if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
-       session->show           = pppol2tp_show;
-#endif
-
-       /* We need to know each time a skb is dropped from the reorder
-        * queue.
-        */
-       session->ref = pppol2tp_session_sock_hold;
-       session->deref = pppol2tp_session_sock_put;
-
-       /* If PMTU discovery was enabled, use the MTU that was discovered */
-       dst = sk_dst_get(tunnel->sock);
-       if (dst != NULL) {
-               u32 pmtu = dst_mtu(dst);
+               pppol2tp_session_init(session);
+               ps = l2tp_session_priv(session);
+               l2tp_session_inc_refcount(session);
 
-               if (pmtu != 0)
-                       session->mtu = session->mru = pmtu -
-                               PPPOL2TP_HEADER_OVERHEAD;
-               dst_release(dst);
+               mutex_lock(&ps->sk_lock);
+               error = l2tp_session_register(session, tunnel);
+               if (error < 0) {
+                       mutex_unlock(&ps->sk_lock);
+                       kfree(session);
+                       goto end;
+               }
+               drop_refcnt = true;
        }
 
        /* Special case: if source & dest session_id == 0x0000, this
@@ -771,12 +789,23 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        po->chan.mtu     = session->mtu;
 
        error = ppp_register_net_channel(sock_net(sk), &po->chan);
-       if (error)
+       if (error) {
+               mutex_unlock(&ps->sk_lock);
                goto end;
+       }
 
 out_no_ppp:
        /* This is how we get the session context from the socket. */
        sk->sk_user_data = session;
+       rcu_assign_pointer(ps->sk, sk);
+       mutex_unlock(&ps->sk_lock);
+
+       /* Keep the reference we've grabbed on the session: sk doesn't expect
+        * the session to disappear. pppol2tp_session_destruct() is responsible
+        * for dropping it.
+        */
+       drop_refcnt = false;
+
        sk->sk_state = PPPOX_CONNECTED;
        l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
                  session->name);
@@ -800,12 +829,11 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
 {
        int error;
        struct l2tp_session *session;
-       struct pppol2tp_session *ps;
 
        /* Error if tunnel socket is not prepped */
        if (!tunnel->sock) {
                error = -ENOENT;
-               goto out;
+               goto err;
        }
 
        /* Default MTU values. */
@@ -820,18 +848,20 @@ static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
                                      peer_session_id, cfg);
        if (IS_ERR(session)) {
                error = PTR_ERR(session);
-               goto out;
+               goto err;
        }
 
-       ps = l2tp_session_priv(session);
-       ps->tunnel_sock = tunnel->sock;
+       pppol2tp_session_init(session);
 
-       l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
-                 session->name);
+       error = l2tp_session_register(session, tunnel);
+       if (error < 0)
+               goto err_sess;
 
-       error = 0;
+       return 0;
 
-out:
+err_sess:
+       kfree(session);
+err:
        return error;
 }
 
@@ -862,9 +892,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                goto end;
 
        pls = l2tp_session_priv(session);
-       tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock);
-       if (tunnel == NULL)
-               goto end_put_sess;
+       tunnel = session->tunnel;
 
        inet = inet_sk(tunnel->sock);
        if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
@@ -944,8 +972,6 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
        *usockaddr_len = len;
        error = 0;
 
-       sock_put(pls->tunnel_sock);
-end_put_sess:
        sock_put(sk);
 end:
        return error;
@@ -992,12 +1018,10 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
                 session->name, cmd, arg);
 
-       sk = ps->sock;
+       sk = pppol2tp_session_get_sock(session);
        if (!sk)
                return -EBADR;
 
-       sock_hold(sk);
-
        switch (cmd) {
        case SIOCGIFMTU:
                err = -ENXIO;
@@ -1143,13 +1167,11 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                        /* resend to session ioctl handler */
                        struct l2tp_session *session =
                                l2tp_session_get(sock_net(sk), tunnel,
-                                                stats.session_id, true);
+                                                stats.session_id);
 
                        if (session) {
                                err = pppol2tp_session_ioctl(session, cmd,
                                                             arg);
-                               if (session->deref)
-                                       session->deref(session);
                                l2tp_session_dec_refcount(session);
                        } else {
                                err = -EBADR;
@@ -1188,7 +1210,6 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
        struct sock *sk = sock->sk;
        struct l2tp_session *session;
        struct l2tp_tunnel *tunnel;
-       struct pppol2tp_session *ps;
        int err;
 
        if (!sk)
@@ -1212,16 +1233,10 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
        /* Special case: if session's session_id is zero, treat ioctl as a
         * tunnel ioctl
         */
-       ps = l2tp_session_priv(session);
        if ((session->session_id == 0) &&
            (session->peer_session_id == 0)) {
-               err = -EBADF;
-               tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-               if (tunnel == NULL)
-                       goto end_put_sess;
-
+               tunnel = session->tunnel;
                err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
-               sock_put(ps->tunnel_sock);
                goto end_put_sess;
        }
 
@@ -1273,7 +1288,6 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                                       int optname, int val)
 {
        int err = 0;
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
 
        switch (optname) {
        case PPPOL2TP_SO_RECVSEQ:
@@ -1294,8 +1308,8 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                }
                session->send_seq = !!val;
                {
-                       struct sock *ssk      = ps->sock;
-                       struct pppox_sock *po = pppox_sk(ssk);
+                       struct pppox_sock *po = pppox_sk(sk);
+
                        po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                }
@@ -1348,7 +1362,6 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
        struct sock *sk = sock->sk;
        struct l2tp_session *session;
        struct l2tp_tunnel *tunnel;
-       struct pppol2tp_session *ps;
        int val;
        int err;
 
@@ -1373,20 +1386,14 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
 
        /* Special case: if session_id == 0x0000, treat as operation on tunnel
         */
-       ps = l2tp_session_priv(session);
        if ((session->session_id == 0) &&
            (session->peer_session_id == 0)) {
-               err = -EBADF;
-               tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-               if (tunnel == NULL)
-                       goto end_put_sess;
-
+               tunnel = session->tunnel;
                err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
-               sock_put(ps->tunnel_sock);
-       } else
+       } else {
                err = pppol2tp_session_setsockopt(sk, session, optname, val);
+       }
 
-end_put_sess:
        sock_put(sk);
 end:
        return err;
@@ -1474,7 +1481,6 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
        struct l2tp_tunnel *tunnel;
        int val, len;
        int err;
-       struct pppol2tp_session *ps;
 
        if (level != SOL_PPPOL2TP)
                return -EINVAL;
@@ -1498,16 +1504,10 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
                goto end;
 
        /* Special case: if session_id == 0x0000, treat as operation on tunnel */
-       ps = l2tp_session_priv(session);
        if ((session->session_id == 0) &&
            (session->peer_session_id == 0)) {
-               err = -EBADF;
-               tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
-               if (tunnel == NULL)
-                       goto end_put_sess;
-
+               tunnel = session->tunnel;
                err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
-               sock_put(ps->tunnel_sock);
                if (err)
                        goto end_put_sess;
        } else {
@@ -1566,7 +1566,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
+       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
        pd->session_idx++;
 
        if (pd->session == NULL) {
@@ -1634,8 +1634,9 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
 {
        struct l2tp_session *session = v;
        struct l2tp_tunnel *tunnel = session->tunnel;
-       struct pppol2tp_session *ps = l2tp_session_priv(session);
-       struct pppox_sock *po = pppox_sk(ps->sock);
+       unsigned char state;
+       char user_data_ok;
+       struct sock *sk;
        u32 ip = 0;
        u16 port = 0;
 
@@ -1645,6 +1646,15 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                port = ntohs(inet->inet_sport);
        }
 
+       sk = pppol2tp_session_get_sock(session);
+       if (sk) {
+               state = sk->sk_state;
+               user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
+       } else {
+               state = 0;
+               user_data_ok = 'N';
+       }
+
        seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
                   "%04X/%04X %d %c\n",
                   session->name, ip, port,
@@ -1652,9 +1662,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                   session->session_id,
                   tunnel->peer_tunnel_id,
                   session->peer_session_id,
-                  ps->sock->sk_state,
-                  (session == ps->sock->sk_user_data) ?
-                  'Y' : 'N');
+                  state, user_data_ok);
        seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
                   session->mtu, session->mru,
                   session->recv_seq ? 'R' : '-',
@@ -1671,8 +1679,12 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                   atomic_long_read(&session->stats.rx_bytes),
                   atomic_long_read(&session->stats.rx_errors));
 
-       if (po)
+       if (sk) {
+               struct pppox_sock *po = pppox_sk(sk);
+
                seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
+               sock_put(sk);
+       }
 }
 
 static int pppol2tp_seq_show(struct seq_file *m, void *v)
@@ -1697,8 +1709,6 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
                pppol2tp_seq_tunnel_show(m, pd->tunnel);
        } else {
                pppol2tp_seq_session_show(m, pd->session);
-               if (pd->session->deref)
-                       pd->session->deref(pd->session);
                l2tp_session_dec_refcount(pd->session);
        }