kernel_optimize_test/net/l2tp
Guillaume Nault f3c66d4e14 l2tp: prevent creation of sessions on terminated tunnels
l2tp_tunnel_destruct() sets tunnel->sock to NULL, then removes the
tunnel from the pernet list and finally closes all its sessions.
Therefore, it's possible to add a session to a tunnel that is still
reachable, but for which tunnel->sock has already been reset. This can
make l2tp_session_create() dereference a NULL pointer when calling
sock_hold(tunnel->sock).

This patch adds the .acpt_newsess field to struct l2tp_tunnel, which is
used by l2tp_tunnel_closeall() to prevent addition of new sessions to
tunnels. Resetting tunnel->sock is done after l2tp_tunnel_closeall()
returned, so that l2tp_session_add_to_tunnel() can safely take a
reference on it when .acpt_newsess is true.

The .acpt_newsess field is modified in l2tp_tunnel_closeall(), rather
than in l2tp_tunnel_destruct(), so that it benefits all tunnel removal
mechanisms. E.g. on UDP tunnels, a session could be added to a tunnel
after l2tp_udp_encap_destroy() proceeded. This would prevent the tunnel
from being removed because of the references held by this new session
on the tunnel and its socket. Even though the session could be removed
manually later on, this defeats the purpose of
commit 9980d001ce ("l2tp: add udp encap socket destroy handler").

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-09-03 11:04:21 -07:00
..
Kconfig
l2tp_core.c l2tp: prevent creation of sessions on terminated tunnels 2017-09-03 11:04:21 -07:00
l2tp_core.h l2tp: prevent creation of sessions on terminated tunnels 2017-09-03 11:04:21 -07:00
l2tp_debugfs.c net, l2tp: convert l2tp_tunnel.ref_count from atomic_t to refcount_t 2017-07-04 22:35:15 +01:00
l2tp_eth.c l2tp: cast l2tp traffic counter to unsigned 2017-06-10 16:14:27 -04:00
l2tp_ip.c l2tp: fix race in l2tp_recv_common() 2017-04-01 20:16:41 -07:00
l2tp_ip6.c l2tp: fix race in l2tp_recv_common() 2017-04-01 20:16:41 -07:00
l2tp_netlink.c l2tp: hold tunnel used while creating sessions with netlink 2017-08-28 11:34:58 -07:00
l2tp_ppp.c net, l2tp: convert l2tp_tunnel.ref_count from atomic_t to refcount_t 2017-07-04 22:35:15 +01:00
Makefile