github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.2
linux/net/l2tp
History
Eric Dumazet 9006c116dd l2tp: fix tunnel and session refcount leak on seq_file release 
In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state
(pd->tunnel and pd->session) is kept in seq_file private data to allow
iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels
before reading to end-of-file (EOF), any tunnel or session reference stored in
pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in
pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Fixes: 0e0c3fee3a ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
Fixes: f726214d9b ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
Reported-by: syzbot+d6fa74e3f19d6ee01e3a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u
Assisted-by: Jetski:Gemini-3.1-Pro
Cc: James Chapman <jchapman@katalix.com>
Cc: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260811144651.2733424-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13 11:49:31 +02:00
..
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
l2tp_core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
l2tp_core.h l2tp: improve tunnel/session refcount helpers 2024-08-11 04:38:50 +01:00
l2tp_debugfs.c l2tp: fix tunnel and session refcount leak on seq_file release 2026-08-13 11:49:31 +02:00
l2tp_eth.c net: l2tp_eth: Replace deprecated strcpy with strscpy in l2tp_eth_create 2026-02-24 13:38:33 +01:00
l2tp_ip.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
l2tp_ip6.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
l2tp_netlink.c genetlink: hold RCU in genlmsg_mcast() 2024-10-15 17:52:58 -07:00
l2tp_ppp.c l2tp: fix tunnel and session refcount leak on seq_file release 2026-08-13 11:49:31 +02:00
Makefile l2tp: add tracepoint infrastructure to core 2020-08-22 12:44:37 -07:00
trace.h l2tp: add tracepoint definitions in trace.h 2020-08-22 12:44:37 -07:00