leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'l2tp-fix-some-races-in-session-deletion'

Browse Source 
Guillaume Nault says:

====================
l2tp: fix some races in session deletion

L2TP provides several interfaces for deleting sessions. Using two of
them concurrently can lead to use-after-free bugs.

Patch #2 uses a flag to prevent double removal of L2TP sessions.
Patch #1 fixes a bug found in the way. Fixing this bug is also
necessary for patch #2 to handle all cases.

This issue is similar to the tunnel deletion bug being worked on by
Sabrina: https://patchwork.ozlabs.org/patch/814173/
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2017-09-25 14:44:41 -07:00
commit 016576d531
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/l2tp/l2tp_core.c
View File

@ -1314,6 +1314,9 @@ again:
hlist_del_init(&session->hlist);
if (test_and_set_bit(0, &session->dead))
goto again;
if (session->ref != NULL)
(*session->ref)(session);
@ -1750,6 +1753,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
*/
int l2tp_session_delete(struct l2tp_session *session)
{
if (test_and_set_bit(0, &session->dead))
return 0;
if (session->ref)
(*session->ref)(session);
__l2tp_session_unhash(session);

1
net/l2tp/l2tp_core.h
View File

@ -76,6 +76,7 @@ struct l2tp_session_cfg {
struct l2tp_session {
int magic; /* should be
* L2TP_SESSION_MAGIC */
long dead;
struct l2tp_tunnel *tunnel; /* back pointer to tunnel
* context */

8
net/l2tp/l2tp_ppp.c
View File

@ -437,11 +437,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
BUG_ON(session->magic != L2TP_SESSION_MAGIC);
if (sock) {
if (sock)
inet_shutdown(sock, SEND_SHUTDOWN);
/* Don't let the session go away before our socket does */
l2tp_session_inc_refcount(session);
}
/* Don't let the session go away before our socket does */
l2tp_session_inc_refcount(session);
}
/* Really kill the session socket. (Called from sock_put() if