All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Guillaume Nault <g.nault@alphalink.fr>,
	"David S. Miller" <davem@davemloft.net>,
	Will Deacon <will@kernel.org>
Subject: [PATCH 4.4 12/29] l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()
Date: Sat, 11 Apr 2020 14:08:42 +0200	[thread overview]
Message-ID: <20200411115409.765238394@linuxfoundation.org> (raw)
In-Reply-To: <20200411115407.651296755@linuxfoundation.org>

From: Guillaume Nault <g.nault@alphalink.fr>

commit b228a94066406b6c456321d69643b0d7ce11cfa6 upstream.

There are several ways to remove L2TP sessions:

  * deleting a session explicitly using the netlink interface (with
    L2TP_CMD_SESSION_DELETE),
  * deleting the session's parent tunnel (either by closing the
    tunnel's file descriptor or using the netlink interface),
  * closing the PPPOL2TP file descriptor of a PPP pseudo-wire.

In some cases, when these methods are used concurrently on the same
session, the session can be removed twice, leading to use-after-free
bugs.

This patch adds a 'dead' flag, used by l2tp_session_delete() and
l2tp_tunnel_closeall() to prevent them from stepping on each other's
toes.

The session deletion path used when closing a PPPOL2TP file descriptor
doesn't need to be adapted. It already has to ensure that a session
remains valid for the lifetime of its PPPOL2TP file descriptor.
So it takes an extra reference on the session in the ->session_close()
callback (pppol2tp_session_close()), which is eventually dropped
in the ->sk_destruct() callback of the PPPOL2TP socket
(pppol2tp_session_destruct()).
Still, __l2tp_session_unhash() and l2tp_session_queue_purge() can be
called twice and even concurrently for a given session, but thanks to
proper locking and re-initialisation of list fields, this is not an
issue.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_core.c |    6 ++++++
 net/l2tp/l2tp_core.h |    1 +
 2 files changed, 7 insertions(+)

--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1351,6 +1351,9 @@ again:
 
 			hlist_del_init(&session->hlist);
 
+			if (test_and_set_bit(0, &session->dead))
+				goto again;
+
 			if (session->ref != NULL)
 				(*session->ref)(session);
 
@@ -1799,6 +1802,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash)
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+	if (test_and_set_bit(0, &session->dead))
+		return 0;
+
 	if (session->ref)
 		(*session->ref)(session);
 	__l2tp_session_unhash(session);
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -85,6 +85,7 @@ struct l2tp_session_cfg {
 struct l2tp_session {
 	int			magic;		/* should be
 						 * L2TP_SESSION_MAGIC */
+	long			dead;
 
 	struct l2tp_tunnel	*tunnel;	/* back pointer to tunnel
 						 * context */



  parent reply	other threads:[~2020-04-11 12:11 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-11 12:08 [PATCH 4.4 00/29] 4.4.219-rc1 review Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 01/29] drm/bochs: downgrade pci_request_region failure from error to warning Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 02/29] ipv4: fix a RCU-list lock in fib_triestat_seq_show Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 03/29] net, ip_tunnel: fix interface lookup with no key Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 04/29] sctp: fix possibly using a bad saddr with a given dst Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 05/29] l2tp: Correctly return -EBADF from pppol2tp_getname Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 06/29] net: l2tp: Make l2tp_ip6 namespace aware Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 07/29] l2tp: fix race in l2tp_recv_common() Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 08/29] l2tp: ensure session cant get removed during pppol2tp_session_ioctl() Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 09/29] l2tp: fix duplicate session creation Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 10/29] l2tp: Refactor the codes with existing macros instead of literal number Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 11/29] l2tp: ensure sessions are freed after their PPPOL2TP socket Greg Kroah-Hartman
2020-04-11 12:08 ` Greg Kroah-Hartman [this message]
2020-04-11 12:08 ` [PATCH 4.4 13/29] usb: gadget: uac2: Drop unused device qualifier descriptor Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 14/29] usb: gadget: printer: " Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 15/29] padata: always acquire cpu_hotplug_lock before pinst->lock Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 16/29] mm: mempolicy: require at least one nodeid for MPOL_PREFERRED Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 17/29] net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 18/29] slcan: Dont transmit uninitialized stack data in padding Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 19/29] random: always use batched entropy for get_random_u{32,64} Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 20/29] tools/accounting/getdelays.c: fix netlink attribute length Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 21/29] power: supply: axp288_charger: Fix unchecked return value Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 22/29] xen-netfront: Fix mismatched rtnl_unlock Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 23/29] xen-netfront: Update features after registering netdev Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 24/29] ASoC: jz4740-i2s: Fix divider written at incorrect offset in register Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 25/29] IB/hfi1: Call kobject_put() when kobject_init_and_add() fails Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 26/29] Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 27/29] RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 28/29] clk: qcom: rcg: Return failure for RCG update Greg Kroah-Hartman
2020-04-11 12:08 ` [PATCH 4.4 29/29] drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() Greg Kroah-Hartman
2020-04-11 20:37 ` [PATCH 4.4 00/29] 4.4.219-rc1 review Guenter Roeck
2020-04-12 10:05 ` Naresh Kamboju
2020-04-13 19:44 ` Chris Paterson
2020-04-14 10:35 ` Jon Hunter
2020-04-14 10:35   ` Jon Hunter
     [not found]   ` <63b31c56-b5c9-2ced-ee00-772fa9a1dcaf-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
2020-04-14 10:57     ` Greg Kroah-Hartman
2020-04-14 10:57       ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200411115409.765238394@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=g.nault@alphalink.fr \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.