Merge branch 'l2tp-fix-some-races-in-session-deletion'

Guillaume Nault says:

====================
l2tp: fix some races in session deletion

L2TP provides several interfaces for deleting sessions. Using two of
them concurrently can lead to use-after-free bugs.

Patch #2 uses a flag to prevent double removal of L2TP sessions.
Patch #1 fixes a bug found in the way. Fixing this bug is also
necessary for patch #2 to handle all cases.

This issue is similar to the tunnel deletion bug being worked on by
Sabrina: https://patchwork.ozlabs.org/patch/814173/
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 11 insertions, 4 deletions

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ee485df73ccd..d8c2a89a76e1 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1314,6 +1314,9 @@ again:
 
                         hlist_del_init(&session->hlist);
 
+                        if (test_and_set_bit(0, &session->dead))
+                                goto again;
+
                         if (session->ref != NULL)
                                 (*session->ref)(session);
 
@@ -1750,6 +1753,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+        if (test_and_set_bit(0, &session->dead))
+                return 0;
+
         if (session->ref)
                 (*session->ref)(session);
         __l2tp_session_unhash(session);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a305e0c5925a..70a12df40a5f 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -76,6 +76,7 @@ struct l2tp_session_cfg {
 struct l2tp_session {
         int                     magic;          /* should be
                                                  * L2TP_SESSION_MAGIC */
+        long                    dead;
 
         struct l2tp_tunnel      *tunnel;        /* back pointer to tunnel
                                                  * context */
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 50e3ee9a9d61..bc6e8bfc5be4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -437,11 +437,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-        if (sock) {
+        if (sock)
                 inet_shutdown(sock, SEND_SHUTDOWN);
-                /* Don't let the session go away before our socket does */
-                l2tp_session_inc_refcount(session);
-        }
+
+        /* Don't let the session go away before our socket does */
+        l2tp_session_inc_refcount(session);
 }
 
 /* Really kill the session socket. (Called from sock_put() if