linux/net/l2tp
Jakub Sitnicki b68777d54f l2tp: Serialize access to sk_user_data with sk_callback_lock
sk->sk_user_data has multiple users, which are not compatible with each
other. Writers must synchronize by grabbing the sk->sk_callback_lock.

l2tp currently fails to grab the lock when modifying the underlying tunnel
socket fields. Fix it by adding appropriate locking.

We err on the side of safety and grab the sk_callback_lock also inside the
sk_destruct callback overridden by l2tp, even though there should be no
refs allowing access to the sock at the time when sk_destruct gets called.

v4:
- serialize write to sk_user_data in l2tp sk_destruct

v3:
- switch from sock lock to sk_callback_lock
- document write-protection for sk_user_data

v2:
- update Fixes to point to origin of the bug
- use real names in Reported/Tested-by tags

Cc: Tom Parkin <tparkin@katalix.com>
Fixes: 3557baabf2 ("[L2TP]: PPP over L2TP driver core")
Reported-by: Haowei Yan <g1042620637@gmail.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-11-16 12:52:19 +00:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
l2tp_core.c l2tp: Serialize access to sk_user_data with sk_callback_lock 2022-11-16 12:52:19 +00:00
l2tp_core.h net/l2tp: convert tunnel rwlock_t to rcu 2021-11-29 12:11:25 +00:00
l2tp_debugfs.c l2tp: l2tp_debugfs: fix Clang -Wformat warnings 2022-07-08 12:14:36 +01:00
l2tp_eth.c l2tp: move from strlcpy with unused retval to strscpy 2022-08-22 17:59:46 -07:00
l2tp_ip6.c ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-08 10:56:43 -07:00
l2tp_ip.c l2tp: use add READ_ONCE() to fetch sk->sk_bound_dev_if 2022-05-16 10:31:06 +01:00
l2tp_netlink.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
l2tp_ppp.c net: l2tp: fix clang -Wformat warning 2022-07-07 18:07:01 -07:00
Makefile l2tp: add tracepoint infrastructure to core 2020-08-22 12:44:37 -07:00
trace.h l2tp: add tracepoint definitions in trace.h 2020-08-22 12:44:37 -07:00