• Sabrina Dubroca's avatar
    l2tp: fix race condition in l2tp_tunnel_delete · 62b982ee
    Sabrina Dubroca authored
    If we try to delete the same tunnel twice, the first delete operation
    does a lookup (l2tp_tunnel_get), finds the tunnel, calls
    l2tp_tunnel_delete, which queues it for deletion by
    l2tp_tunnel_del_work.
    
    The second delete operation also finds the tunnel and calls
    l2tp_tunnel_delete. If the workqueue has already fired and started
    running l2tp_tunnel_del_work, then l2tp_tunnel_delete will queue the
    same tunnel a second time, and try to free the socket again.
    
    Add a dead flag to prevent firing the workqueue twice. Then we can
    remove the check of queue_work's result that was meant to prevent that
    race but doesn't.
    
    Reproducer:
    
        ip l2tp add tunnel tunnel_id 3000 peer_tunnel_id 4000 local 192.168.0.2 remote 192.168.0.1 encap udp udp_sport 5000 udp_dport 6000
        ip l2tp add session name l2tp1 tunnel_id 3000 session_id 1000 peer_session_id 2000
        ip link set l2tp1 up
        ip l2tp del tunnel tunnel_id 3000
        ip l2tp del tunnel tunnel_id 3000
    
    Fixes: f8ccac0e ("l2tp: put tunnel socket release on a workqueue")
    Reported-by: 's avatarJianlin Shi <jishi@redhat.com>
    Signed-off-by: 's avatarSabrina Dubroca <sd@queasysnail.net>
    Acked-by: 's avatarGuillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    62b982ee
l2tp_core.c 51.5 KB