Sabrina Dubroca 2f86953e74 l2tp: fix use-after-free during module unload ... Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the socket, the private data reserved via the net_generic mechanism has already been freed, but l2tp_tunnel_destruct() actually uses this data. Make sure tunnel deletion for the netns has completed before returning from l2tp_exit_net() by first flushing the tunnel removal workqueue, and then waiting for RCU callbacks to complete. Fixes: 167eb17e0b ("l2tp: create tunnel sockets in the right namespace") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-09-02 11:44:44 -07:00
..
Kconfig	…
Makefile	…
l2tp_core.c	l2tp: fix use-after-free during module unload	2016-09-02 11:44:44 -07:00
l2tp_core.h	…
l2tp_debugfs.c	…
l2tp_eth.c	net: add netdev_lockdep_set_classes() helper	2016-06-09 13:28:37 -07:00
l2tp_ip.c	…
l2tp_ip6.c	ipv6: use TOS marks from sockets for routing decision	2016-06-11 15:33:26 -07:00
l2tp_netlink.c	…
l2tp_ppp.c	l2tp: Fix the connect status check in pppol2tp_getname	2016-08-19 17:55:43 -07:00