l2tp: fix race in l2tp_recv_dequeue() (e2e210c0) · Commits · e / devices / android_kernel_xiaomi_markw

Misha Labjuk reported panics occurring in l2tp_recv_dequeue() If we release reorder_q.lock, we must not keep a dangling pointer (tmp), since another thread could manipulate reorder_q. Instead we must restart the scan at beginning of list. Reported-by:

Misha Labjuk <spiked.yar@gmail.com> Tested-by:

Misha Labjuk <spiked.yar@gmail.com> Signed-off-by:

Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/l2tp/l2tp_core.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -397,6 +397,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
		* expect to send up next, dequeue it and any other
		* in-sequence packets behind it.
		*/
		start:
		spin_lock_bh(&session->reorder_q.lock);
		skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
		if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
		@@ -433,7 +434,7 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
		*/
		spin_unlock_bh(&session->reorder_q.lock);
		l2tp_recv_dequeue_skb(session, skb);
		spin_lock_bh(&session->reorder_q.lock);
		goto start;
		}

		out: