lkml.org 
[lkml]   [2018]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 083/122] l2tp: dont use inet_shutdown on tunnel destroy
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: James Chapman <jchapman@katalix.com>


    [ Upstream commit 76a6abdb2513ad4ea0ded55d2c66160491f2e848 ]

    Previously, if a tunnel was closed, we called inet_shutdown to mark
    the socket as unconnected such that userspace would get errors and
    then close the socket. This could race with userspace closing the
    socket. Instead, leave userspace to close the socket in its own time
    (our tunnel will be detached anyway).

    BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
    IP: __lock_acquire+0x263/0x1630
    PGD 0 P4D 0
    Oops: 0000 [#1] SMP KASAN
    Modules linked in:
    CPU: 2 PID: 42 Comm: kworker/u8:2 Not tainted 4.15.0-rc7+ #129
    Workqueue: l2tp l2tp_tunnel_del_work
    RIP: 0010:__lock_acquire+0x263/0x1630
    RSP: 0018:ffff88001a37fc70 EFLAGS: 00010002
    RAX: 0000000000000001 RBX: 0000000000000088 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
    RBP: ffff88001a37fd18 R08: 0000000000000001 R09: 0000000000000000
    R10: 0000000000000000 R11: 00000000000076fd R12: 00000000000000a0
    R13: ffff88001a3722c0 R14: 0000000000000001 R15: 0000000000000000
    FS: 0000000000000000(0000) GS:ffff88001ad00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000000000a0 CR3: 000000001730b000 CR4: 00000000000006e0
    Call Trace:
    ? __lock_acquire+0xc77/0x1630
    ? console_trylock+0x11/0xa0
    lock_acquire+0x117/0x230
    ? lock_sock_nested+0x3a/0xa0
    _raw_spin_lock_bh+0x3a/0x50
    ? lock_sock_nested+0x3a/0xa0
    lock_sock_nested+0x3a/0xa0
    inet_shutdown+0x33/0xf0
    l2tp_tunnel_del_work+0x60/0xef
    process_one_work+0x1ea/0x5f0
    ? process_one_work+0x162/0x5f0
    worker_thread+0x48/0x3e0
    ? trace_hardirqs_on+0xd/0x10
    kthread+0x108/0x140
    ? process_one_work+0x5f0/0x5f0
    ? kthread_stop+0x2a0/0x2a0
    ret_from_fork+0x24/0x30
    Code: 00 41 81 ff ff 1f 00 00 0f 87 7a 13 00 00 45 85 f6 49 8b 85
    68 08 00 00 0f 84 ae 03 00 00 c7 44 24 18 00 00 00 00 e9 f0 00 00 00 <49> 81 3c
    24 80 93 3f 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f
    RIP: __lock_acquire+0x263/0x1630 RSP: ffff88001a37fc70
    CR2: 00000000000000a0

    Fixes: 309795f4bec2d ("l2tp: Add netlink control API for L2TP")
    Signed-off-by: James Chapman <jchapman@katalix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/l2tp/l2tp_core.c | 11 ++---------
    1 file changed, 2 insertions(+), 9 deletions(-)

    --- a/net/l2tp/l2tp_core.c
    +++ b/net/l2tp/l2tp_core.c
    @@ -1336,17 +1336,10 @@ static void l2tp_tunnel_del_work(struct

    sock = sk->sk_socket;

    - /* If the tunnel socket was created by userspace, then go through the
    - * inet layer to shut the socket down, and let userspace close it.
    - * Otherwise, if we created the socket directly within the kernel, use
    + /* If the tunnel socket was created within the kernel, use
    * the sk API to release it here.
    - * In either case the tunnel resources are freed in the socket
    - * destructor when the tunnel socket goes away.
    */
    - if (tunnel->fd >= 0) {
    - if (sock)
    - inet_shutdown(sock, 2);
    - } else {
    + if (tunnel->fd < 0) {
    if (sock) {
    kernel_sock_shutdown(sock, SHUT_RDWR);
    sock_release(sock);

    \
     
     \ /
      Last update: 2018-03-07 20:43    [W:4.833 / U:0.692 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site