stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Giuliano Procida <gprocida@google.com>
To: greg@kroah.com
Cc: stable@vger.kernel.org, Guillaume Nault <g.nault@alphalink.fr>,
	"David S . Miller" <davem@davemloft.net>,
	Giuliano Procida <gprocida@google.com>
Subject: [PATCH v2 15/22] l2tp: hold tunnel used while creating sessions with netlink
Date: Fri, 22 May 2020 00:39:30 +0100	[thread overview]
Message-ID: <20200521233937.175182-16-gprocida@google.com> (raw)
In-Reply-To: <20200521233937.175182-1-gprocida@google.com>

From: Guillaume Nault <g.nault@alphalink.fr>

commit e702c1204eb57788ef189c839c8c779368267d70 upstream.

Use l2tp_tunnel_get() to retrieve tunnel, so that it can't go away on
us. Otherwise l2tp_tunnel_destruct() might release the last reference
count concurrently, thus freeing the tunnel while we're using it.

Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Giuliano Procida <gprocida@google.com>
---
 net/l2tp/l2tp_netlink.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 8f39086de144..5ea5d3ffa309 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -510,8 +510,9 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 		ret = -EINVAL;
 		goto out;
 	}
+
 	tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
-	tunnel = l2tp_tunnel_find(net, tunnel_id);
+	tunnel = l2tp_tunnel_get(net, tunnel_id);
 	if (!tunnel) {
 		ret = -ENODEV;
 		goto out;
@@ -519,24 +520,24 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 
 	if (!info->attrs[L2TP_ATTR_SESSION_ID]) {
 		ret = -EINVAL;
-		goto out;
+		goto out_tunnel;
 	}
 	session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
 
 	if (!info->attrs[L2TP_ATTR_PEER_SESSION_ID]) {
 		ret = -EINVAL;
-		goto out;
+		goto out_tunnel;
 	}
 	peer_session_id = nla_get_u32(info->attrs[L2TP_ATTR_PEER_SESSION_ID]);
 
 	if (!info->attrs[L2TP_ATTR_PW_TYPE]) {
 		ret = -EINVAL;
-		goto out;
+		goto out_tunnel;
 	}
 	cfg.pw_type = nla_get_u16(info->attrs[L2TP_ATTR_PW_TYPE]);
 	if (cfg.pw_type >= __L2TP_PWTYPE_MAX) {
 		ret = -EINVAL;
-		goto out;
+		goto out_tunnel;
 	}
 
 	if (tunnel->version > 2) {
@@ -555,7 +556,7 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 			u16 len = nla_len(info->attrs[L2TP_ATTR_COOKIE]);
 			if (len > 8) {
 				ret = -EINVAL;
-				goto out;
+				goto out_tunnel;
 			}
 			cfg.cookie_len = len;
 			memcpy(&cfg.cookie[0], nla_data(info->attrs[L2TP_ATTR_COOKIE]), len);
@@ -564,7 +565,7 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 			u16 len = nla_len(info->attrs[L2TP_ATTR_PEER_COOKIE]);
 			if (len > 8) {
 				ret = -EINVAL;
-				goto out;
+				goto out_tunnel;
 			}
 			cfg.peer_cookie_len = len;
 			memcpy(&cfg.peer_cookie[0], nla_data(info->attrs[L2TP_ATTR_PEER_COOKIE]), len);
@@ -607,7 +608,7 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 	if ((l2tp_nl_cmd_ops[cfg.pw_type] == NULL) ||
 	    (l2tp_nl_cmd_ops[cfg.pw_type]->session_create == NULL)) {
 		ret = -EPROTONOSUPPORT;
-		goto out;
+		goto out_tunnel;
 	}
 
 	/* Check that pseudowire-specific params are present */
@@ -617,7 +618,7 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 	case L2TP_PWTYPE_ETH_VLAN:
 		if (!info->attrs[L2TP_ATTR_VLAN_ID]) {
 			ret = -EINVAL;
-			goto out;
+			goto out_tunnel;
 		}
 		break;
 	case L2TP_PWTYPE_ETH:
@@ -645,6 +646,8 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
 		}
 	}
 
+out_tunnel:
+	l2tp_tunnel_dec_refcount(tunnel);
 out:
 	return ret;
 }
-- 
2.27.0.rc0.183.gde8f92d652-goog


  parent reply	other threads:[~2020-05-21 23:40 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-21 14:40 [PATCH 00/22] l2tp locking and ordering fixes Giuliano Procida
2020-05-21 14:40 ` [PATCH 01/22] net: l2tp: export debug flags to UAPI Giuliano Procida
2020-05-21 14:40 ` [PATCH 02/22] net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_* Giuliano Procida
2020-05-21 14:40 ` [PATCH 03/22] net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_* Giuliano Procida
2020-05-21 14:40 ` [PATCH 04/22] New kernel function to get IP overhead on a socket Giuliano Procida
2020-05-21 14:40 ` [PATCH 05/22] L2TP:Adjust intf MTU, add underlay L3, L2 hdrs Giuliano Procida
2020-05-21 14:40 ` [PATCH 06/22] l2tp: remove useless duplicate session detection in l2tp_netlink Giuliano Procida
2020-05-21 14:40 ` [PATCH 07/22] l2tp: remove l2tp_session_find() Giuliano Procida
2020-05-21 14:40 ` [PATCH 08/22] l2tp: define parameters of l2tp_session_get*() as "const" Giuliano Procida
2020-05-21 14:40 ` [PATCH 09/22] l2tp: define parameters of l2tp_tunnel_find*() " Giuliano Procida
2020-05-21 14:40 ` [PATCH 10/22] l2tp: initialise session's refcount before making it reachable Giuliano Procida
2020-05-21 14:40 ` [PATCH 11/22] l2tp: hold tunnel while looking up sessions in l2tp_netlink Giuliano Procida
2020-05-21 14:40 ` [PATCH 12/22] l2tp: hold tunnel while processing genl delete command Giuliano Procida
2020-05-21 14:40 ` [PATCH 13/22] l2tp: hold tunnel while handling genl tunnel updates Giuliano Procida
2020-05-21 14:40 ` [PATCH 14/22] l2tp: hold tunnel while handling genl TUNNEL_GET commands Giuliano Procida
2020-05-21 14:40 ` [PATCH 15/22] l2tp: hold tunnel used while creating sessions with netlink Giuliano Procida
2020-05-21 14:40 ` [PATCH 16/22] l2tp: prevent creation of sessions on terminated tunnels Giuliano Procida
2020-05-21 14:40 ` [PATCH 17/22] l2tp: pass tunnel pointer to ->session_create() Giuliano Procida
2020-05-21 14:40 ` [PATCH 18/22] l2tp: fix l2tp_eth module loading Giuliano Procida
2020-05-21 14:40 ` [PATCH 19/22] l2tp: don't register sessions in l2tp_session_create() Giuliano Procida
2020-05-21 14:40 ` [PATCH 20/22] l2tp: initialise l2tp_eth sessions before registering them Giuliano Procida
2020-05-21 14:40 ` [PATCH 21/22] l2tp: protect sock pointer of struct pppol2tp_session with RCU Giuliano Procida
2020-05-21 14:41 ` [PATCH 22/22] l2tp: initialise PPP sessions before registering them Giuliano Procida
2020-05-21 23:39 ` [PATCH v2 00/22] l2tp locking and ordering fixes Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 01/22] net: l2tp: export debug flags to UAPI Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 02/22] net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_* Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 03/22] net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_* Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 04/22] New kernel function to get IP overhead on a socket Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 05/22] L2TP:Adjust intf MTU, add underlay L3, L2 hdrs Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 06/22] l2tp: remove useless duplicate session detection in l2tp_netlink Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 07/22] l2tp: remove l2tp_session_find() Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 08/22] l2tp: define parameters of l2tp_session_get*() as "const" Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 09/22] l2tp: define parameters of l2tp_tunnel_find*() " Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 10/22] l2tp: initialise session's refcount before making it reachable Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 11/22] l2tp: hold tunnel while looking up sessions in l2tp_netlink Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 12/22] l2tp: hold tunnel while processing genl delete command Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 13/22] l2tp: hold tunnel while handling genl tunnel updates Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 14/22] l2tp: hold tunnel while handling genl TUNNEL_GET commands Giuliano Procida
2020-05-21 23:39   ` Giuliano Procida [this message]
2020-05-21 23:39   ` [PATCH v2 16/22] l2tp: prevent creation of sessions on terminated tunnels Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 17/22] l2tp: pass tunnel pointer to ->session_create() Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 18/22] l2tp: fix l2tp_eth module loading Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 19/22] l2tp: don't register sessions in l2tp_session_create() Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 20/22] l2tp: initialise l2tp_eth sessions before registering them Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 21/22] l2tp: protect sock pointer of struct pppol2tp_session with RCU Giuliano Procida
2020-05-21 23:39   ` [PATCH v2 22/22] l2tp: initialise PPP sessions before registering them Giuliano Procida
2020-05-22 12:15   ` [PATCH v2 00/22] l2tp locking and ordering fixes Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200521233937.175182-16-gprocida@google.com \
    --to=gprocida@google.com \
    --cc=davem@davemloft.net \
    --cc=g.nault@alphalink.fr \
    --cc=greg@kroah.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).