linux-toradex.git/net/l2tp, branch v3.2.26

l2tp: fix a race in l2tp_ip_sendmsg()

2012-07-12T03:32:13+00:00

[ Upstream commit 4399a4df98a63e30fd16e9d0cecc46ea92269e8f ]

Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
a race, in case IP route cache is disabled.

In this case, we should not do the dst_release(&rt->dst), since it'll
free the dst immediately, instead of waiting a RCU grace period.

Signed-off-by: Eric Dumazet 
Cc: James Chapman 
Cc: Denys Fedoryshchenko 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

net: l2tp_eth: fix kernel panic on rmmod l2tp_eth

2012-07-12T03:32:12+00:00

[ Upstream commit a06998b88b1651c5f71c0e35f528bf2057188ead ]

We must prevent module unloading if some devices are still attached to
l2tp_eth driver.

Signed-off-by: Eric Dumazet 
Reported-by: Denys Fedoryshchenko 
Tested-by: Denys Fedoryshchenko 
Cc: James Chapman 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case

2012-06-10T13:42:03+00:00

[ Upstream commit c51ce49735c183ef2592db70f918ee698716276b ]

An application may call connect() to disconnect a socket using an
address with family AF_UNSPEC. The L2TP IP sockets were not handling
this case when the socket is not bound and an attempt to connect()
using AF_UNSPEC in such cases would result in an oops. This patch
addresses the problem by protecting the sk_prot->disconnect() call
against trying to unhash the socket before it is bound.

The patch also adds more checks that the sockaddr supplied to bind()
and connect() calls is valid.

 RIP: 0010:[]  [] inet_unhash+0x50/0xd0
 RSP: 0018:ffff88001989be28  EFLAGS: 00010293
 Stack:
  ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
  ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
  0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
 Call Trace:
 [] udp_disconnect+0x1f9/0x290
 [] inet_dgram_connect+0x29/0x80
 [] sys_connect+0x9c/0x100

Reported-by: Sasha Levin 
Signed-off-by: James Chapman 
Signed-off-by: Ben Hutchings

net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg

2012-05-20T21:56:35+00:00

[ Upstream commit 84768edbb2721637620b2d84501bb0d5aed603f1 ]

l2tp_ip_sendmsg could return without releasing socket lock, making it all the
way to userspace, and generating the following warning:

[  130.891594] ================================================
[  130.894569] [ BUG: lock held when returning to user space! ]
[  130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G        W
[  130.900336] ------------------------------------------------
[  130.902996] trinity/8384 is leaving the kernel with locks still held!
[  130.906106] 1 lock held by trinity/8384:
[  130.907924]  #0:  (sk_lock-AF_INET){+.+.+.}, at: [] l2tp_ip_sendmsg+0x2f/0x550

Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c").

Signed-off-by: Sasha Levin 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

Fix pppol2tp getsockname()

2012-04-02T16:53:07+00:00

[ Upstream commit bbdb32cb5b73597386913d052165423b9d736145 ]

While testing L2TP functionality, I came across a bug in getsockname().  The
IP address returned within the pppol2tp_addr's addr memember was not being
set to the IP  address in use.  This bug is caused by using inet_sk() on the
wrong socket (the L2TP socket rather than the underlying UDP socket), and was
likely introduced during the addition of L2TPv3 support.

Signed-off-by: Benjamin LaHaise 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

l2tp: l2tp_ip - fix possible oops on packet receive

2012-02-03T17:22:19+00:00

[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]

When a packet is received on an L2TP IP socket (L2TPv3 IP link
encapsulation), the l2tpip socket's backlog_rcv function calls
xfrm4_policy_check(). This is not necessary, since it was called
before the skb was added to the backlog. With CONFIG_NET_NS enabled,
xfrm4_policy_check() will oops if skb->dev is null, so this trivial
patch removes the call.

This bug has always been present, but only when CONFIG_NET_NS is
enabled does it cause problems. Most users are probably using UDP
encapsulation for L2TP, hence the problem has only recently
surfaced.

EIP: 0060:[] EFLAGS: 00210246 CPU: 0
EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [] sock_common_recvmsg+0x31/0x46
 [] __sock_recvmsg_nosec+0x45/0x4d
 [] __sock_recvmsg+0x31/0x3b
 [] sock_recvmsg+0x96/0xab
 [] ? might_fault+0x47/0x81
 [] ? might_fault+0x47/0x81
 [] ? _copy_from_user+0x31/0x115
 [] ? copy_from_user+0x8/0xa
 [] ? verify_iovec+0x3e/0x78
 [] __sys_recvmsg+0x10a/0x1aa
 [] ? sock_recvmsg+0x0/0xab
 [] ? __lock_acquire+0xbdf/0xbee
 [] ? do_page_fault+0x193/0x375
 [] ? fcheck_files+0x9b/0xca
 [] ? fget_light+0x2a/0x9c
 [] sys_recvmsg+0x2b/0x43
 [] sys_socketcall+0x16d/0x1a5
 [] ? trace_hardirqs_on_thunk+0xc/0x10
 [] sysenter_do_call+0x12/0x38
Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff  76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c

Signed-off-by: James Chapman 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

l2tp: ensure sk->dst is still valid

2011-11-26T20:57:36+00:00

When using l2tp over ipsec, the tunnel will hang when rekeying
occurs. Reason is that the transformer bundle attached to the dst entry
is now in STATE_DEAD and thus xfrm_output_one() drops all packets
(XfrmOutStateExpired increases).

Fix this by calling __sk_dst_check (which drops the stale dst
if xfrm dst->check callback finds that the bundle is no longer valid).

Cc: James Chapman 
Signed-off-by: Florian Westphal 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

l2tp: fix l2tp_udp_recv_core()

2011-11-08T18:59:44+00:00

pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

l2tp: fix race in l2tp_recv_dequeue()

2011-11-03T22:02:13+00:00

Misha Labjuk reported panics occurring in l2tp_recv_dequeue()

If we release reorder_q.lock, we must not keep a dangling pointer (tmp),
since another thread could manipulate reorder_q.

Instead we must restart the scan at beginning of list.

Reported-by: Misha Labjuk 
Tested-by: Misha Labjuk 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'master' of ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2011-10-24T22:18:09+00:00