Skip to content

l2tp use-after-free fixes for 4.9 stable

Will Deacon lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 3 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2l2tp: ensure sessions are freed after their PPPOL2TP socketnet/l2tp/l2tp_ppp.c+4 -42 replies
2/2l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()net/l2tp/l2tp_core.c net/l2tp/l2tp_core.h+7 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/2] [backports] l2tp use-after-free fixes for 4.9 stable

Hi Greg,

Syzbot has been complaining about KASAN splats due to use-after-free issues in the l2tp code on 4.9 Android kernels (although I reproduced with latest 4.9 stable on my laptop):

https://syzkaller.appspot.com/bug?id=3c27eae7bdba97293b68e79c9700ac110f977eed

These have been fixed upstream, but for some reason didn't get picked up for stable. This series applies to 4.9.y and I'll send patches for 4.4.y separately as there are a few dependencies to deal with over there.

Thanks,

Will

--->8

Guillaume Nault (2):
l2tp: ensure sessions are freed after their PPPOL2TP socket
l2tp: fix race between l2tp_session_delete() and
l2tp_tunnel_closeall()

 net/l2tp/l2tp_core.c | 6 ++++++
 net/l2tp/l2tp_core.h | 1 +
 net/l2tp/l2tp_ppp.c  | 8 ++++----
 3 files changed, 11 insertions(+), 4 deletions(-)
Signature · 1 line
2.26.0.rc2.310.g2932bb562d-goog

Read the cover letter in its thread