ip6tnl: fix use after free of fb_tnl_dev

[~andy/linux] / net / l2tp / l2tp_debugfs.c

diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 072d7202e182ffa2125fe7de9c54c584626fdeb0..2d6760a2ae347b96d465e30192ab8a7957258d32 100644 (file)
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -127,9 +127,10 @@ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
 
 #if IS_ENABLED(CONFIG_IPV6)
                if (tunnel->sock->sk_family == AF_INET6) {
-                       struct ipv6_pinfo *np = inet6_sk(tunnel->sock);
+                       const struct ipv6_pinfo *np = inet6_sk(tunnel->sock);
+
                        seq_printf(m, " from %pI6c to %pI6c\n",
-                               &np->saddr, &np->daddr);
+                               &np->saddr, &tunnel->sock->sk_v6_daddr);
                } else
 #endif
                seq_printf(m, " from %pI4 to %pI4\n",