Cong Wang 0b2c59720e l2tp: close all race conditions in l2tp_tunnel_register() ... The code in l2tp_tunnel_register() is racy in several ways: 1. It modifies the tunnel socket _after_ publishing it. 2. It calls setup_udp_tunnel_sock() on an existing socket without locking. 3. It changes sock lock class on fly, which triggers many syzbot reports. This patch amends all of them by moving socket initialization code before publishing and under sock lock. As suggested by Jakub, the l2tp lockdep class is not necessary as we can just switch to bh_lock_sock_nested(). Fixes: 37159ef2c1 ("l2tp: fix a lockdep splat") Fixes: 6b9f34239b ("l2tp: fix races in tunnel creation") Reported-by: syzbot+52866e24647f9a23403f@syzkaller.appspotmail.com Reported-by: syzbot+94cc2a66fc228b23f360@syzkaller.appspotmail.com Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Guillaume Nault <gnault@redhat.com> Cc: Jakub Sitnicki <jakub@cloudflare.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Tom Parkin <tparkin@katalix.com> Signed-off-by: Cong Wang <cong.wang@bytedance.com> Reviewed-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2023-01-16 13:40:55 +00:00
..
6lowpan	…
9p	xen: branch for v6.2-rc4	2023-01-12 17:02:20 -06:00
802	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
8021q	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
appletalk	…
atm	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
ax25	ax25: af_ax25: Remove unnecessary (void*) conversions	2022-11-16 13:31:03 +00:00
batman-adv	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
bluetooth	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
bpf	New Feature:	2022-12-17 14:06:53 -06:00
bpfilter	…
bridge	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
caif	caif: fix memory leak in cfctrl_linkup_request()	2023-01-05 10:19:36 +01:00
can	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
ceph	Treewide: Stop corrupting socket's task_frag	2022-12-19 17:28:49 -08:00
core	gro: take care of DODGY packets	2023-01-09 07:37:07 +00:00
dcb	net: dcb: move getapptrust to separate function	2022-11-15 15:27:43 +01:00
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-11-29 13:04:52 -08:00
dns_resolver	cred: Do not default to init_cred in prepare_kernel_cred()	2022-11-01 10:04:52 -07:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-12-13 09:49:29 +01:00
ethernet	net: ethernet: use sysfs_emit() to instead of scnprintf()	2022-12-07 20:02:44 -08:00
ethtool	ethtool: add netlink attr in rss get reply only if value is not null	2023-01-12 21:52:46 -08:00
hsr	hsr: Use a single struct for self_node.	2022-12-01 20:26:22 -08:00
ieee802154	Merge tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next	2022-12-07 17:33:26 -08:00
ife	…
ipv4	Including fixes from bpf, wifi, and netfilter.	2023-01-05 12:40:50 -08:00
ipv6	ipv6: raw: Deduct extension header length in rawv6_push_pending_frames	2023-01-11 12:49:13 +00:00
iucv	…
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2022-11-29 20:50:51 -08:00
l2tp	l2tp: close all race conditions in l2tp_tunnel_register()	2023-01-16 13:40:55 +00:00
l3mdev	…
lapb	…
llc	…
mac80211	wifi: mac80211: fix MLO + AP_VLAN check	2023-01-10 13:24:30 +01:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-12-08 18:19:59 -08:00
mctp	mctp: Remove device type check at unregister	2022-12-19 17:20:22 -08:00
mpls	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
mptcp	mptcp: netlink: respect v4/v6-only sockets	2023-01-13 21:55:45 -08:00
ncsi	net/ncsi: Silence runtime memcpy() false positive warning	2022-12-06 17:29:14 -08:00
netfilter	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits	2023-01-11 19:18:04 +01:00
netlabel	…
netlink	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
netrom	…
nfc	net: nfc: Fix use-after-free in local_cleanup()	2023-01-13 20:53:44 -08:00
nsh	…
openvswitch	net: openvswitch: release vport resources on failure	2022-12-21 17:48:12 -08:00
packet	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
phonet	…
psample	…
qrtr	…
rds	rds: remove redundant variable total_payload_len	2022-11-04 10:09:50 +00:00
rfkill	driver core: make struct class.dev_uevent() take a const *	2022-11-24 17:12:15 +01:00
rose	rose: Fix NULL pointer dereference in rose_send_frame()	2022-11-02 11:57:30 +00:00
rxrpc	rxrpc: Fix wrong error return in rxrpc_connect_call()	2023-01-12 21:51:55 -08:00
sched	net/sched: sch_taprio: fix possible use-after-free	2023-01-16 13:25:34 +00:00
sctp	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
smc	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
strparser	…
sunrpc	nfsd-6.2 fixes:	2023-01-10 15:03:06 -06:00
switchdev	…
tipc	tipc: fix unexpected link reset due to discovery messages	2023-01-06 12:53:10 +00:00
tls	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
unix	unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()	2022-12-15 11:35:18 +01:00
vmw_vsock	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
wireless	Driver Core changes for 6.2-rc1	2022-12-16 03:54:54 -08:00
x25	net/x25: Fix skb leak in x25_lapb_receive_frame()	2022-11-15 20:22:19 -08:00
xdp	bpf: Expand map key argument of bpf_redirect_map to u64	2022-11-15 09:00:27 -08:00
xfrm	Treewide: Stop corrupting socket's task_frag	2022-12-19 17:28:49 -08:00
Kconfig	…
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	…
compat.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
devres.c	…
socket.c	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
sysctl_net.c	…