Re: [PATCH net] l2tp: fix use-after-free during module unload

2016-09-01 Thread David Miller
From: Sabrina Dubroca Date: Tue, 30 Aug 2016 16:05:16 +0200 > Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq > -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> > l2tp_tunnel_destruct). > > By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish

Re: [PATCH net] l2tp: fix use-after-free during module unload

2016-08-30 Thread Sergei Shtylyov
Hello. On 08/30/2016 05:05 PM, Sabrina Dubroca wrote: Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the

[PATCH net] l2tp: fix use-after-free during module unload

2016-08-30 Thread Sabrina Dubroca
Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the socket, the private data reserved via the net_generic mec