netdev - [PATCH net-next v2 03/16] l2tp: don't use inet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Feb 2018 10:11:07 +0000
From:   James Chapman <jchapman@...alix.com>
To:     netdev@...r.kernel.org
Cc:     kbuild-all@...org
Subject: [PATCH net-next v2 03/16] l2tp: don't use inet_shutdown on tunnel destroy

Previously, if a tunnel was closed, we called inet_shutdown to mark
the socket as unconnected such that userspace would get errors and
then close the socket. This could race with userspace closing the
socket. Instead, leave userspace to close the socket in its own time
(our tunnel will be detached anyway).

Fixes: 309795f4be ("l2tp: Add netlink control API for L2TP")

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
 IP: __lock_acquire+0x263/0x1630
 PGD 0 P4D 0
 Oops: 0000 [#1] SMP KASAN
 Modules linked in:
 CPU: 2 PID: 42 Comm: kworker/u8:2 Not tainted 4.15.0-rc7+ #129
 Workqueue: l2tp l2tp_tunnel_del_work
 RIP: 0010:__lock_acquire+0x263/0x1630
 RSP: 0018:ffff88001a37fc70 EFLAGS: 00010002
 RAX: 0000000000000001 RBX: 0000000000000088 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
 RBP: ffff88001a37fd18 R08: 0000000000000001 R09: 0000000000000000
 R10: 0000000000000000 R11: 00000000000076fd R12: 00000000000000a0
 R13: ffff88001a3722c0 R14: 0000000000000001 R15: 0000000000000000
 FS:  0000000000000000(0000) GS:ffff88001ad00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000a0 CR3: 000000001730b000 CR4: 00000000000006e0
 Call Trace:
  ? __lock_acquire+0xc77/0x1630
  ? console_trylock+0x11/0xa0
  lock_acquire+0x117/0x230
  ? lock_sock_nested+0x3a/0xa0
  _raw_spin_lock_bh+0x3a/0x50
  ? lock_sock_nested+0x3a/0xa0
  lock_sock_nested+0x3a/0xa0
  inet_shutdown+0x33/0xf0
  l2tp_tunnel_del_work+0x60/0xef
  process_one_work+0x1ea/0x5f0
  ? process_one_work+0x162/0x5f0
  worker_thread+0x48/0x3e0
  ? trace_hardirqs_on+0xd/0x10
  kthread+0x108/0x140
  ? process_one_work+0x5f0/0x5f0
  ? kthread_stop+0x2a0/0x2a0
  ret_from_fork+0x24/0x30
 Code: 00 41 81 ff ff 1f 00 00 0f 87 7a 13 00 00 45 85 f6 49 8b 85
 68 08 00 00 0f 84 ae 03 00 00 c7 44 24 18 00 00 00 00 e9 f0 00 00 00 <49> 81 3c
 24 80 93 3f 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f
 RIP: __lock_acquire+0x263/0x1630 RSP: ffff88001a37fc70
 CR2: 00000000000000a0
---
 net/l2tp/l2tp_core.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index de7dce64173f..b68ae77e021e 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1329,17 +1329,10 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
 
 	sock = sk->sk_socket;
 
-	/* If the tunnel socket was created by userspace, then go through the
-	 * inet layer to shut the socket down, and let userspace close it.
-	 * Otherwise, if we created the socket directly within the kernel, use
+	/* If the tunnel socket was created within the kernel, use
 	 * the sk API to release it here.
-	 * In either case the tunnel resources are freed in the socket
-	 * destructor when the tunnel socket goes away.
 	 */
-	if (tunnel->fd >= 0) {
-		if (sock)
-			inet_shutdown(sock, 2);
-	} else {
+	if (tunnel->fd < 0) {
 		if (sock) {
 			kernel_sock_shutdown(sock, SHUT_RDWR);
 			sock_release(sock);
-- 
1.9.1