• Sabrina Dubroca's avatar
    l2tp: fix use-after-free during module unload · 2f86953e
    Sabrina Dubroca authored
    Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq
     -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU ->
    l2tp_tunnel_destruct).
    
    By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish
    destroying the socket, the private data reserved via the net_generic
    mechanism has already been freed, but l2tp_tunnel_destruct() actually
    uses this data.
    
    Make sure tunnel deletion for the netns has completed before returning
    from l2tp_exit_net() by first flushing the tunnel removal workqueue, and
    then waiting for RCU callbacks to complete.
    
    Fixes: 167eb17e ("l2tp: create tunnel sockets in the right namespace")
    Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    2f86953e
l2tp_core.c 51.2 KB