linux-stable/include/net
Jakub Sitnicki 7188c37f3c l2tp: Serialize access to sk_user_data with sk_callback_lock
[ Upstream commit b68777d54f ]

sk->sk_user_data has multiple users, which are not compatible with each
other. Writers must synchronize by grabbing the sk->sk_callback_lock.

l2tp currently fails to grab the lock when modifying the underlying tunnel
socket fields. Fix it by adding appropriate locking.

We err on the side of safety and grab the sk_callback_lock also inside the
sk_destruct callback overridden by l2tp, even though there should be no
refs allowing access to the sock at the time when sk_destruct gets called.

v4:
- serialize write to sk_user_data in l2tp sk_destruct

v3:
- switch from sock lock to sk_callback_lock
- document write-protection for sk_user_data

v2:
- update Fixes to point to origin of the bug
- use real names in Reported/Tested-by tags

Cc: Tom Parkin <tparkin@katalix.com>
Fixes: 3557baabf2 ("[L2TP]: PPP over L2TP driver core")
Reported-by: Haowei Yan <g1042620637@gmail.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-06 07:52:37 +01:00
..
9p
bluetooth Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put 2022-08-03 11:59:37 +02:00
caif net: caif: add proper error handling 2021-06-10 13:37:09 +02:00
iucv
netfilter netfilter: conntrack: re-fetch conntrack after insertion 2022-06-06 08:33:50 +02:00
netns ipv4: convert fib_num_tclassid_users to atomic_t 2021-12-08 09:01:12 +01:00
nfc NFC: add NCI_UNREG flag to eliminate the race 2021-12-01 09:23:35 +01:00
phonet
sctp sctp: fix memory leak in sctp_stream_outq_migrate() 2022-12-08 11:23:03 +01:00
tc_act net/sched: act_pedit: really ensure the skb is writable 2022-05-18 09:47:25 +02:00
6lowpan.h
act_api.h net: sched: fix police ext initialization 2021-03-04 10:26:53 +01:00
addrconf.h ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr 2022-08-03 11:59:39 +02:00
af_ieee802154.h
af_rxrpc.h rxrpc: Make rxrpc_kernel_get_srtt() indicate validity 2020-09-09 19:12:23 +02:00
af_unix.h
af_vsock.h
ah.h
arp.h ipv4: Invalidate neighbour for broadcast address upon address addition 2022-04-15 14:18:33 +02:00
atmclip.h
ax25.h ax25: fix reference count leaks of ax25_dev 2022-04-20 09:19:39 +02:00
ax88796.h
bond_3ad.h bonding: fix data-races around agg_select_timer 2022-02-23 11:59:58 +01:00
bond_alb.h bonding: make tx_rebalance_counter an atomic 2021-12-14 14:49:00 +01:00
bond_options.h
bonding.h bonding: Rename slave_arr to usable_slaves 2023-01-18 11:41:05 +01:00
bpf_sk_storage.h bpf: support cloning sk storage on accept() 2019-08-17 23:18:54 +02:00
busy_poll.h net: Fix a data-race around sysctl_net_busy_poll. 2022-09-05 10:27:42 +02:00
calipso.h
cfg80211-wext.h
cfg80211.h mac80211: properly handle A-MSDUs that start with an RFC 1042 header 2021-06-03 08:59:01 +02:00
cfg802154.h
checksum.h net: Force inlining of checksum functions in net/checksum.h 2022-03-02 11:41:08 +01:00
cipso_ipv4.h
cls_cgroup.h
codel.h
codel_impl.h
codel_qdisc.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h devlink: disallow reload operation during device cleanup 2019-11-09 19:38:36 -08:00
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
drop_monitor.h net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() 2020-05-27 17:46:24 +02:00
dsa.h net: dsa: Pass ndo_setup_tc slave callback to drivers 2019-09-16 21:32:57 +02:00
dsfield.h
dst.h net: add atomic_long_t to net_device_stats fields 2023-01-18 11:41:37 +01:00
dst_cache.h
dst_metadata.h net: fix a memleak when uncloning an skb dst and its metadata 2022-02-16 12:52:51 +01:00
dst_ops.h net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 19:18:58 +01:00
erspan.h
esp.h esp: limit skb_page_frag_refill use to a single page 2022-07-12 16:30:45 +02:00
ethoc.h
failover.h
fib_notifier.h
fib_rules.h ipv6: fix memory leak in fib6_rule_suppress 2021-12-08 09:01:13 +01:00
firewire.h
flow.h ipv4: Initialize flowi4_multipath_hash in data path 2020-09-26 18:03:12 +02:00
flow_dissector.h net/sched: flower: fix parsing of ethertype following VLAN header 2022-04-20 09:19:34 +02:00
flow_offload.h net: core: rename indirect block ingress cb function 2019-12-18 16:08:47 +01:00
fou.h
fq.h net/flow_dissector: switch to siphash 2019-10-23 20:13:22 -07:00
fq_impl.h net/fq_impl: Switch to kvmalloc() for memory allocation 2019-11-08 09:11:49 +01:00
garp.h
gen_stats.h
genetlink.h genetlink: remove genl_bind 2020-07-22 09:32:46 +02:00
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h
hwbm.h net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static 2019-10-25 16:24:32 -07:00
icmp.h net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-04 10:26:53 +01:00
ieee80211_radiotap.h
ieee802154_netdev.h net: ieee802154: return -EINVAL for unknown addr type 2022-10-26 13:22:59 +02:00
if_inet6.h ipv6: fix locking issues with loops over idev->addr_list 2022-06-14 18:11:25 +02:00
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h
inet_connection_sock.h tcp: relookup sock for RST+ACK packets handled by obsolete req sock 2021-03-30 14:35:26 +02:00
inet_ecn.h inet_ecn: Fix endianness of checksum update when setting ECT(1) 2020-12-08 10:40:25 +01:00
inet_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-01-27 09:19:54 +01:00
inet_hashtables.h secure_seq: use the 64 bits of the siphash for port offset calculation 2022-06-06 08:33:49 +02:00
inet_sock.h tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. 2022-07-29 17:14:11 +02:00
inet_timewait_sock.h tcp: honor SO_PRIORITY in TIME_WAIT state 2019-09-27 12:05:02 +02:00
inetpeer.h
ip.h ip: Fix a data-race around sysctl_fwmark_reflect. 2022-07-29 17:14:11 +02:00
ip6_checksum.h
ip6_fib.h ipv6: annotate accesses to fn->fn_sernum 2022-02-01 17:24:38 +01:00
ip6_route.h net: ipv6: fix returned variable type in ip6_skb_dst_mtu 2021-08-12 13:20:57 +02:00
ip6_tunnel.h
ip_fib.h ipv4: convert fib_num_tclassid_users to atomic_t 2021-12-08 09:01:12 +01:00
ip_tunnels.h ip_tunnels: Set tunnel option flag when tunnel metadata is present 2020-11-24 13:29:05 +01:00
ip_vs.h ipvs: allow connection reuse for unconfirmed conntrack 2020-08-19 08:16:10 +02:00
ipcomp.h
ipconfig.h
ipv6.h net: ipv6: add net argument to ip6_dst_lookup_flow 2019-12-18 16:08:40 +01:00
ipv6_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-01-27 09:19:54 +01:00
ipv6_stubs.h net: ipv6: add fib6_nh_release_dsts stub 2021-12-01 09:23:33 +01:00
ipx.h bonding/alb: properly access headers in bond_alb_xmit() 2020-02-11 04:35:48 -08:00
iw_handler.h
kcm.h
l3mdev.h
lag.h
lapb.h
lib80211.h
llc.h llc: fix out-of-bound array index in llc_sk_dev_hash() 2021-11-17 09:48:47 +01:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h llc: fix sk_buff leak in llc_conn_service() 2019-10-08 13:23:05 -07:00
llc_if.h
llc_pdu.h net: llc: fix skb_over_panic 2021-08-04 12:27:39 +02:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h
mac80211.h mac80211: populate debugfs only after cfg80211 init 2020-04-29 16:33:18 +02:00
mac802154.h
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mrp.h mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 11:41:37 +01:00
ncsi.h
ndisc.h net: avoid potential false sharing in neighbor related code 2019-12-31 16:45:03 +01:00
neighbour.h net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 2021-11-17 09:48:49 +01:00
net_failover.h
net_namespace.h net: make get_net_ns return error if NET_NS is disabled 2021-06-23 14:41:25 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h netlink: Fix nlmsg_parse as a wrapper for strict message parsing 2019-08-13 20:37:16 -07:00
netprio_cgroup.h
netrom.h
nexthop.h net: ipv4: Fix rtnexthop len when RTA_FLOW is present 2021-10-06 15:42:33 +02:00
nl802154.h net: ieee802154: handle iftypes as u32 2021-12-01 09:23:32 +01:00
nsh.h
p8022.h
page_pool.h mm: fix struct page layout on 32-bit systems 2021-05-19 10:08:31 +02:00
ping.h
pkt_cls.h net_sched: fix ops->bind_class() implementations 2020-02-01 09:34:38 +00:00
pkt_sched.h net: prevent user from passing illegal stab size 2021-10-17 10:42:34 +02:00
pptp.h
protocol.h tcp/udp: Make early_demux back namespacified. 2022-11-10 17:57:55 +01:00
psample.h psample: Add a fwd declaration for skbuff 2021-08-18 08:56:59 +02:00
psnap.h
raw.h raw: Fix a data-race around sysctl_raw_l3mdev_accept. 2022-07-21 20:59:22 +02:00
rawv6.h
red.h sch_red: fix off-by-one checks in red_check_params() 2021-04-14 08:24:14 +02:00
regulatory.h
request_sock.h net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head 2019-10-09 21:34:31 -07:00
rose.h
route.h ipv4: remove sparse error in ip_neigh_gw4() 2022-02-01 17:24:39 +01:00
rsi_91x.h
rtnetlink.h can: dev: Move device back to init netns on owning netns delete 2021-03-30 14:35:29 +02:00
rtnh.h
sch_generic.h net/sched: sch_taprio: fix possible use-after-free 2023-02-06 07:52:37 +01:00
scm.h
secure_seq.h secure_seq: use the 64 bits of the siphash for port offset calculation 2022-06-06 08:33:49 +02:00
seg6.h
seg6_hmac.h
seg6_local.h
slhc_vj.h
smc.h
snmp.h
sock.h l2tp: Serialize access to sk_user_data with sk_callback_lock 2023-02-06 07:52:37 +01:00
sock_reuseport.h udp: correct reuseport selection with connected sockets 2019-09-16 09:02:18 +02:00
Space.h
stp.h
strparser.h bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-17 09:48:48 +01:00
switchdev.h
tcp.h tcp/udp: Make early_demux back namespacified. 2022-11-10 17:57:55 +01:00
tcp_states.h
timewait_sock.h
tipc.h
tls.h net/tls: Fix flipped sign in tls_err_abort() calls 2021-11-02 19:46:12 +01:00
transp_v6.h
tso.h
tun_proto.h
udp.h tcp/udp: Make early_demux back namespacified. 2022-11-10 17:57:55 +01:00
udp_tunnel.h udp: call udp_encap_enable for v6 sockets when enabling encap 2022-04-15 14:18:01 +02:00
udplite.h
vsock_addr.h
vxlan.h vxlan: add adjacent link to limit depth level 2019-10-24 14:53:49 -07:00
wext.h
wimax.h
x25.h
x25device.h
xdp.h
xdp_priv.h page_pool: do not release pool until inflight == 0. 2019-12-18 16:09:07 +01:00
xdp_sock.h xsk: add support to allow unaligned chunk placement 2019-08-31 01:08:26 +02:00
xfrm.h xfrm: Check if_id in xfrm_migrate 2022-03-19 13:40:16 +01:00