l2tp use-after-free fixes for 4.4 stable
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest8 patches 2 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/8 | l2tp: Correctly return -EBADF from pppol2tp_getname.net/ | +2 | 0 replies | |
| 2/8 | net: l2tp: Make l2tp_ip6 namespace awarenet/ | +7 | 0 replies | |
| 3/8 | l2tp: fix race in l2tp_recv_common()net/ net/ net/ +1 more | +88 | 0 replies | |
| 4/8 | l2tp: ensure session can't get removed during pppol2tp_session_ioctl()net/ | +11 | 0 replies | |
| 5/8 | l2tp: fix duplicate session creationnet/ net/ net/ | +84 | 0 replies | |
| 6/8 | l2tp: Refactor the codes with existing macros instead of literal numbernet/ | +9 | 0 replies | |
| 7/8 | l2tp: ensure sessions are freed after their PPPOL2TP socketnet/ | +4 | 0 replies | |
| 8/8 | l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()net/ net/ | +7 | 0 replies |
Reviews trailers per patch
1 of 8 patches has a Reviewed-by or Acked-by.
| Patch | Guillaume Nault |
|---|---|
| 1/8 | |
| 2/8 | |
| 3/8 | |
| 4/8 | |
| 5/8 | |
| 6/8 | A-b |
| 7/8 | |
| 8/8 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/8] [backports] l2tp use-after-free fixes for 4.4 stable
Hi Greg,
Syzbot has been complaining about KASAN splats due to use-after-free issues in the l2tp code on 4.4 Android kernels (although I reproduced with latest 4.4 stable on my laptop):
https://syzkaller.appspot.com/bug?id=de316389db0fa0cd7ced6e564601ea8e56625ebc
These have been fixed upstream, but for some reason didn't get picked up for stable. This series applies to 4.4.y and I've sent patches for 4.9 separately.
Thanks,
Will
--->8
Gao Feng (1):
l2tp: Refactor the codes with existing macros instead of literal
number
Guillaume Nault (5):
l2tp: fix race in l2tp_recv_common()
l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
l2tp: fix duplicate session creation
l2tp: ensure sessions are freed after their PPPOL2TP socket
l2tp: fix race between l2tp_session_delete() and
l2tp_tunnel_closeall()
Shmulik Ladkani (1):
net: l2tp: Make l2tp_ip6 namespace aware
[email protected] (1):
l2tp: Correctly return -EBADF from pppol2tp_getname.
net/l2tp/l2tp_core.c | 149 ++++++++++++++++++++++++++++++++++--------- net/l2tp/l2tp_core.h | 4 ++ net/l2tp/l2tp_eth.c | 10 +-- net/l2tp/l2tp_ip.c | 17 +++-- net/l2tp/l2tp_ip6.c | 28 +++++--- net/l2tp/l2tp_ppp.c | 110 ++++++++++++++++---------------- 6 files changed, 211 insertions(+), 107 deletions(-)
Signature · 1 line
2.26.0.rc2.310.g2932bb562d-goog