Re: [PATCH net v2] l2tp: fix use-after-free during module unload

2016-09-02 Thread David Miller
From: Sabrina Dubroca Date: Fri, 2 Sep 2016 10:22:54 +0200 > Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq > -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> > l2tp_tunnel_destruct). > > By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish

[PATCH net v2] l2tp: fix use-after-free during module unload

2016-09-02 Thread Sabrina Dubroca
Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU -> l2tp_tunnel_destruct). By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish destroying the socket, the private data reserved via the net_generic mec