torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

l2tp: do not use sock_hold() in pppol2tp_session_get_sock()

Browse Source 
pppol2tp_session_get_sock() is using RCU, it must be ready
for sk_refcnt being zero.

Commit ee40fb2e1e ("l2tp: protect sock pointer of
struct pppol2tp_session with RCU") was correct because it
had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit.

pppol2tp_recv() can use pppol2tp_session_get_sock() as well.

Fixes: c5cbaef992 ("l2tp: refactor ppp socket/session relationship")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Link: https://patch.msgid.link/20250826134435.1683435-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2025-08-26 13:44:35 +00:00 committed by Jakub Kicinski
parent 2e87504692
commit 9b8c88f875
1 changed files with 8 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
net/l2tp/l2tp_ppp.c
View File

@ -129,22 +129,12 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = {
static const struct proto_ops pppol2tp_ops; static const struct proto_ops pppol2tp_ops;
/* Retrieves the pppol2tp socket associated to a session. /* Retrieves the pppol2tp socket associated to a session. */
* A reference is held on the returned socket, so this function must be paired
* with sock_put().
*/
static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
{ {
struct pppol2tp_session *ps = l2tp_session_priv(session); struct pppol2tp_session *ps = l2tp_session_priv(session);
struct sock *sk;
rcu_read_lock(); return rcu_dereference(ps->sk);
sk = rcu_dereference(ps->sk);
if (sk)
sock_hold(sk);
rcu_read_unlock();
return sk;
} }
/* Helpers to obtain tunnel/session contexts from sockets. /* Helpers to obtain tunnel/session contexts from sockets.
@ -206,14 +196,13 @@ end:
static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
{ {
struct pppol2tp_session *ps = l2tp_session_priv(session); struct sock *sk;
struct sock *sk = NULL;
/* If the socket is bound, send it in to PPP's input queue. Otherwise /* If the socket is bound, send it in to PPP's input queue. Otherwise
* queue it on the session socket. * queue it on the session socket.
*/ */
rcu_read_lock(); rcu_read_lock();
sk = rcu_dereference(ps->sk); sk = pppol2tp_session_get_sock(session);
if (!sk) if (!sk)
goto no_sock; goto no_sock;
@ -510,13 +499,14 @@ static void pppol2tp_show(struct seq_file *m, void *arg)
struct l2tp_session *session = arg; struct l2tp_session *session = arg;
struct sock *sk; struct sock *sk;
rcu_read_lock();
sk = pppol2tp_session_get_sock(session); sk = pppol2tp_session_get_sock(session);
if (sk) { if (sk) {
struct pppox_sock *po = pppox_sk(sk); struct pppox_sock *po = pppox_sk(sk);
seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
sock_put(sk);
} }
rcu_read_unlock();
} }
static void pppol2tp_session_init(struct l2tp_session *session) static void pppol2tp_session_init(struct l2tp_session *session)
@ -1530,6 +1520,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
port = ntohs(inet->inet_sport); port = ntohs(inet->inet_sport);
} }
rcu_read_lock();
sk = pppol2tp_session_get_sock(session); sk = pppol2tp_session_get_sock(session);
if (sk) { if (sk) {
state = sk->sk_state; state = sk->sk_state;
@ -1565,8 +1556,8 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
struct pppox_sock *po = pppox_sk(sk); struct pppox_sock *po = pppox_sk(sk);
seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
sock_put(sk);
} }
rcu_read_unlock();
} }
static int pppol2tp_seq_show(struct seq_file *m, void *v) static int pppol2tp_seq_show(struct seq_file *m, void *v)