From: David S. Miller Date: Sun, 2 Apr 2017 03:16:42 +0000 (-0700) Subject: Merge branch 'l2tp_session_find-fixes' X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=e5c1e5198068ed896a8a80b8ed9e202bbab18851;p=openwrt%2Fstaging%2Fblogic.git Merge branch 'l2tp_session_find-fixes' Guillaume Nault says: ==================== l2tp: fix usage of l2tp_session_find() l2tp_session_find() doesn't take a reference on the session returned to its caller. Virtually all l2tp_session_find() users are racy, either because the session can disappear from under them or because they take a reference too late. This leads to bugs like 'use after free' or failure to notice duplicate session creations. In some cases, taking a reference on the session is not enough. The special callbacks .ref() and .deref() also have to be called in cases where the PPP pseudo-wire uses the socket associated with the session. Therefore, when looking up a session, we also have to pass a flag indicating if the .ref() callback has to be called. In the future, we probably could drop the .ref() and .deref() callbacks entirely by protecting the .sock field of struct pppol2tp_session with RCU, thus allowing it to be freed and set to NULL even if the L2TP session is still alive. ==================== Signed-off-by: David S. Miller --- e5c1e5198068ed896a8a80b8ed9e202bbab18851