Skip to content

l2tp: fix some races in session deletion

Guillaume Nault netdev 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 1 replyIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2l2tp: ensure sessions are freed after their PPPOL2TP socketnet/l2tp/l2tp_ppp.c+4 -40 replies
2/2l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()net/l2tp/l2tp_core.c net/l2tp/l2tp_core.h+7 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH net 0/2] l2tp: fix some races in session deletion

L2TP provides several interfaces for deleting sessions. Using two of them concurrently can lead to use-after-free bugs.

Patch #2 uses a flag to prevent double removal of L2TP sessions. Patch #1 fixes a bug found in the way. Fixing this bug is also necessary for patch #2 to handle all cases.

This issue is similar to the tunnel deletion bug being worked on by
Sabrina: https://patchwork.ozlabs.org/patch/814173/

Guillaume Nault (2):
l2tp: ensure sessions are freed after their PPPOL2TP socket
l2tp: fix race between l2tp_session_delete() and
l2tp_tunnel_closeall()

 net/l2tp/l2tp_core.c | 6 ++++++
 net/l2tp/l2tp_core.h | 1 +
 net/l2tp/l2tp_ppp.c  | 8 ++++----
 3 files changed, 11 insertions(+), 4 deletions(-)
Signature · 1 line
2.14.1

Read the cover letter in its thread