Sabrina Dubroca 2f86953e74 l2tp: fix use-after-free during module unload ... Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the socket, the private data reserved via the net_generic mechanism has already been freed, but l2tp_tunnel_destruct() actually uses this data. Make sure tunnel deletion for the netns has completed before returning from l2tp_exit_net() by first flushing the tunnel removal workqueue, and then waiting for RCU callbacks to complete. Fixes: 167eb17e0b ("l2tp: create tunnel sockets in the right namespace") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-09-02 11:44:44 -07:00
..
6lowpan	6lowpan: ndisc: set invalid unicast short addr to unspec	2016-07-08 13:23:12 +02:00
9p	9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()	2016-08-09 13:42:36 +03:00
802
8021q	net: remove type_check from dev_get_nest_level()	2016-08-13 15:15:54 -07:00
appletalk
atm	net: add dev arg to ndo_neigh_construct/destroy	2016-07-05 09:06:28 -07:00
ax25	AX.25: Close socket connection on session completion	2016-06-18 20:55:34 -07:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-07-24 00:53:32 -04:00
bluetooth	Bluetooth: Fix hci_sock_recvmsg when MSG_TRUNC is not set	2016-08-25 20:58:47 +02:00
bridge	net: bridge: don't increment tx_dropped in br_do_proxy_arp	2016-09-01 16:35:30 -07:00
caif	caif: Remove unneeded header file	2016-06-28 05:26:14 -04:00
can	can: only call can_stat_update with procfs	2016-06-23 11:23:49 +02:00
ceph	libceph: using kfree_rcu() to simplify the code	2016-08-08 21:41:42 +02:00
core	rps: flow_dissector: Fix uninitialized flow_keys used in __skb_get_hash possibly	2016-09-01 22:45:03 -07:00
dcb
dccp	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-07-29 17:38:46 -07:00
decnet	net: fix decnet rtnexthop parsing	2016-07-05 14:08:47 -07:00
dns_resolver
dsa	net: dsa: support switchdev ageing time attr	2016-07-19 19:42:01 -07:00
ethernet
hsr
ieee802154	ieee802154: 6lowpan: fix intra pan id check	2016-07-08 13:23:12 +02:00
ipv4	tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data	2016-09-01 16:40:15 -07:00
ipv6	ipv6: Don't unset flowi6_proto in ipxip6_tnl_xmit()	2016-09-01 23:41:24 -07:00
ipx
irda	net/irda: handle iriap_register_lsap() allocation failure	2016-08-13 15:09:07 -07:00
iucv	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-07-29 17:38:46 -07:00
kcm	kcm: fix a socket double free	2016-08-31 21:00:19 -07:00
key
l2tp	l2tp: fix use-after-free during module unload	2016-09-02 11:44:44 -07:00
l3mdev	net: vrf: Implement get_saddr for IPv6	2016-06-17 21:25:29 -07:00
lapb
llc
mac80211	mac80211: TDLS: don't require beaconing for AP BW	2016-08-30 08:03:41 +02:00
mac802154
mpls	mpls: allow routes on ipip and sit devices	2016-07-09 17:45:56 -04:00
ncsi	net/ncsi: avoid maybe-uninitialized warning	2016-07-25 10:32:59 -07:00
netfilter	netfilter: nf_tables_netdev: remove redundant ip_hdr assignment	2016-08-30 11:41:04 +02:00
netlabel	netlabel: Implement CALIPSO config functions for SMACK.	2016-06-27 15:06:18 -04:00
netlink	net/netlink/af_netlink.h: Remove unused structure.	2016-06-09 22:26:24 -07:00
netrom
nfc	NFC: digital: Fix RTOX supervisor PDU handling	2016-07-11 02:02:03 +02:00
openvswitch	openvswitch: do not ignore netdev errors when creating tunnel vports	2016-08-10 23:13:23 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-07-24 00:53:32 -04:00
phonet
qrtr
rds	RDS: TCP: Enable multipath RDS for TCP	2016-07-15 11:36:58 -07:00
rfkill
rose	rose: limit sk_filter trim to payload	2016-07-13 11:53:40 -07:00
rxrpc	rxrpc: Free packets discarded in data_ready	2016-08-09 17:13:56 +01:00
sched	qdisc: fix a module refcount leak in qdisc_create_dflt()	2016-08-25 16:44:20 -07:00
sctp	sctp: fix overrun in sctp_diag_dump_one()	2016-08-23 17:22:53 -07:00
sunrpc	NFS client bugfixes for Linux 4.8	2016-08-12 12:32:24 -07:00
switchdev	net/switchdev: Export the same parent ID service function	2016-07-14 13:34:29 -07:00
tipc	tipc: fix random link resets while adding a second bearer	2016-09-01 10:12:26 -07:00
unix	af_unix: charge buffers to kmemcg	2016-07-26 16:19:19 -07:00
vmw_vsock	vhost/vsock: drop space available check for TX vq	2016-08-15 05:05:21 +03:00
wimax
wireless	Three little fixes:	2016-08-30 21:34:48 -07:00
x25
xfrm
compat.c	packet: compat support for sock_fprog	2016-06-09 23:41:03 -07:00
Kconfig	net/ncsi: Resource management	2016-07-19 20:49:16 -07:00
Makefile	net/ncsi: Resource management	2016-07-19 20:49:16 -07:00
socket.c
sysctl_net.c