linux-toradex.git/net/l2tp, branch v3.9.6

l2tp: fix info leak in l2tp_ip6_recvmsg()

2013-04-07T20:28:01+00:00

The L2TP code for IPv6 fails to initialize the l2tp_conn_id member of
struct sockaddr_l2tpip6 and therefore leaks four bytes kernel stack
in l2tp_ip6_recvmsg() in case msg_name is set.

Initialize l2tp_conn_id with 0 to avoid the info leak.

Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller

l2tp: unhash l2tp sessions on delete, not on free

2013-03-20T16:10:39+00:00

If we postpone unhashing of l2tp sessions until the structure is freed, we
risk:

 1. further packets arriving and getting queued while the pseudowire is being
    closed down
 2. the recv path hitting "scheduling while atomic" errors in the case that
    recv drops the last reference to a session and calls l2tp_session_free
    while in atomic context

As such, l2tp sessions should be unhashed from l2tp_core data structures early
in the teardown process prior to calling pseudowire close.  For pseudowires
like l2tp_ppp which have multiple shutdown codepaths, provide an unhash hook.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: avoid deadlock in l2tp stats update

2013-03-20T16:10:39+00:00

l2tp's u64_stats writers were incorrectly synchronised, making it possible to
deadlock a 64bit machine running a 32bit kernel simply by sending the l2tp
code netlink commands while passing data through l2tp sessions.

Previous discussion on netdev determined that alternative solutions such as
spinlock writer synchronisation or per-cpu data would bring unjustified
overhead, given that most users interested in high volume traffic will likely
be running 64bit kernels on 64bit hardware.

As such, this patch replaces l2tp's use of u64_stats with atomic_long_t,
thereby avoiding the deadlock.

Ref:
http://marc.info/?l=linux-netdev&m=134029167910731&w=2
http://marc.info/?l=linux-netdev&m=134079868111131&w=2

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: push all ppp pseudowire shutdown through .release handler

2013-03-20T16:10:39+00:00

If userspace deletes a ppp pseudowire using the netlink API, either by
directly deleting the session or by deleting the tunnel that contains the
session, we need to tear down the corresponding pppox channel.

Rather than trying to manage two pppox unbind codepaths, switch the netlink
and l2tp_core session_close handlers to close via. the l2tp_ppp socket
.release handler.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: purge session reorder queue on delete

2013-03-20T16:10:39+00:00

Add calls to l2tp_session_queue_purge as a part of l2tp_tunnel_closeall
and l2tp_session_delete.  Pseudowire implementations which are deleted only
via. l2tp_core l2tp_session_delete calls can dispense with their own code for
flushing the reorder queue.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: add session reorder queue purge function to core

2013-03-20T16:10:39+00:00

If an l2tp session is deleted, it is necessary to delete skbs in-flight
on the session's reorder queue before taking it down.

Rather than having each pseudowire implementation reaching into the
l2tp_session struct to handle this itself, provide a function in l2tp_core to
purge the session queue.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: don't BUG_ON sk_socket being NULL

2013-03-20T16:10:39+00:00

It is valid for an existing struct sock object to have a NULL sk_socket
pointer, so don't BUG_ON in l2tp_tunnel_del_work if that should occur.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: take a reference for kernel sockets in l2tp_tunnel_sock_lookup

2013-03-20T16:10:38+00:00

When looking up the tunnel socket in struct l2tp_tunnel, hold a reference
whether the socket was created by the kernel or by userspace.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: close sessions before initiating tunnel delete

2013-03-20T16:10:38+00:00

When a user deletes a tunnel using netlink, all the sessions in the tunnel
should also be deleted.  Since running sessions will pin the tunnel socket
with the references they hold, have the l2tp_tunnel_delete close all sessions
in a tunnel before finally closing the tunnel socket.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: close sessions in ip socket destroy callback

2013-03-20T16:10:38+00:00

l2tp_core hooks UDP's .destroy handler to gain advance warning of a tunnel
socket being closed from userspace.  We need to do the same thing for
IP-encapsulation sockets.

Signed-off-by: Tom Parkin 
Signed-off-by: James Chapman 
Signed-off-by: David S. Miller