• Tom Parkin's avatar
    l2tp: prevent l2tp_tunnel_delete racing with userspace close · 80d84ef3
    Tom Parkin authored
    If a tunnel socket is created by userspace, l2tp hooks the socket destructor
    in order to clean up resources if userspace closes the socket or crashes.  It
    also caches a pointer to the struct sock for use in the data path and in the
    netlink interface.
    
    While it is safe to use the cached sock pointer in the data path, where the
    skb references keep the socket alive, it is not safe to use it elsewhere as
    such access introduces a race with userspace closing the socket.  In
    particular, l2tp_tunnel_delete is prone to oopsing if a multithreaded
    userspace application closes a socket at the same time as sending a netlink
    delete command for the tunnel.
    
    This patch fixes this oops by forcing l2tp_tunnel_delete to explicitly look up
    a tunnel socket held by userspace using sockfd_lookup().
    Signed-off-by: default avatarTom Parkin <tparkin@katalix.com>
    Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    80d84ef3
l2tp_core.h 9.33 KB