Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Sabrina Dubroca 047a7e9c84 l2tp: fix use-after-free during module unload ... commit 2f86953e74 upstream. Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the socket, the private data reserved via the net_generic mechanism has already been freed, but l2tp_tunnel_destruct() actually uses this data. Make sure tunnel deletion for the netns has completed before returning from l2tp_exit_net() by first flushing the tunnel removal workqueue, and then waiting for RCU callbacks to complete. Fixes: 167eb17e0b ("l2tp: create tunnel sockets in the right namespace") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2016-11-20 01:17:22 +00:00
..
Kconfig	net/l2tp: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:01 -08:00
l2tp_core.c	l2tp: fix use-after-free during module unload	2016-11-20 01:17:22 +00:00
l2tp_core.h	l2tp: Add support for zero IPv6 checksums	2014-05-23 16:28:53 -04:00
l2tp_debugfs.c	ipv6: make lookups simpler and faster	2013-10-09 00:01:25 -04:00
l2tp_eth.c	l2tp: fix oops in l2tp_eth_create() error path	2012-11-02 21:56:35 -04:00
l2tp_ip.c	ipv4: l2tp: fix a potential issue in l2tp_ip_recv	2016-05-01 00:06:15 +02:00
l2tp_ip6.c	ipv6: l2tp: fix a potential issue in l2tp_ip6_recv	2016-05-01 00:06:15 +02:00
l2tp_netlink.c	l2tp: Add support for zero IPv6 checksums	2014-05-23 16:28:53 -04:00
l2tp_ppp.c	l2tp: Correctly return -EBADF from pppol2tp_getname.	2016-11-20 01:16:58 +00:00
Makefile	l2tp: introduce L2TPv3 IP encapsulation support for IPv6	2012-05-01 09:30:55 -04:00