WSL2-Linux-Kernel/net/l2tp
Sabrina Dubroca 2f86953e74 l2tp: fix use-after-free during module unload
Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq
 -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU ->
l2tp_tunnel_destruct).

By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish
destroying the socket, the private data reserved via the net_generic
mechanism has already been freed, but l2tp_tunnel_destruct() actually
uses this data.

Make sure tunnel deletion for the netns has completed before returning
from l2tp_exit_net() by first flushing the tunnel removal workqueue, and
then waiting for RCU callbacks to complete.

Fixes: 167eb17e0b ("l2tp: create tunnel sockets in the right namespace")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-02 11:44:44 -07:00
..
Kconfig l2tp: Call udp_sock_create 2014-07-14 16:12:15 -07:00
Makefile l2tp: introduce L2TPv3 IP encapsulation support for IPv6 2012-05-01 09:30:55 -04:00
l2tp_core.c l2tp: fix use-after-free during module unload 2016-09-02 11:44:44 -07:00
l2tp_core.h l2tp: auto load type modules 2015-09-25 12:27:22 -07:00
l2tp_debugfs.c ipv6: make lookups simpler and faster 2013-10-09 00:01:25 -04:00
l2tp_eth.c net: add netdev_lockdep_set_classes() helper 2016-06-09 13:28:37 -07:00
l2tp_ip.c ipv4: l2tp: fix a potential issue in l2tp_ip_recv 2016-04-04 16:00:28 -04:00
l2tp_ip6.c ipv6: use TOS marks from sockets for routing decision 2016-06-11 15:33:26 -07:00
l2tp_netlink.c l2tp: use nla_put_u64_64bit() 2016-04-25 15:09:10 -04:00
l2tp_ppp.c l2tp: Fix the connect status check in pppol2tp_getname 2016-08-19 17:55:43 -07:00