diff mbox series

[net-next,v2,11/16] l2tp: do session destroy using a workqueue

Message ID 1518430280-16671-12-git-send-email-jchapman@katalix.com
State Changes Requested, archived
Delegated to: David Miller
Headers show
Series l2tp: fix API races discovered by syzbot | expand

Commit Message

James Chapman Feb. 12, 2018, 10:11 a.m. UTC 
Handle session destroy in the same way as we handle tunnel destroy -
through a workqueue. Sessions can be destroyed either because its
socket is closed (if it has a socket) or by netlink request. A
workqueue synchronises these.
---
 net/l2tp/l2tp_core.c | 30 +++++++++++++++++++++++-------
 net/l2tp/l2tp_core.h |  2 ++
 2 files changed, 25 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index d6306ba2d78e..55b1f312fedc 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1702,6 +1702,24 @@  void __l2tp_session_unhash(struct l2tp_session *session)
 }
 EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
 
+/* Workqueue session deletion function */
+static void l2tp_session_del_work(struct work_struct *work)
+{
+	struct l2tp_session *session = container_of(work, struct l2tp_session,
+						    del_work);
+
+	__l2tp_session_unhash(session);
+	l2tp_session_queue_purge(session);
+	if (session->session_close)
+		(*session->session_close)(session);
+
+	/* drop initial ref */
+	l2tp_session_dec_refcount(session);
+
+	/* drop workqueue ref */
+	l2tp_session_dec_refcount(session);
+}
+
 /* This function is used by the netlink SESSION_DELETE command and by
    pseudowire modules.
  */
@@ -1715,13 +1733,9 @@  int l2tp_session_delete(struct l2tp_session *session)
 	session->closing = true;
 	spin_unlock_bh(&session->lock);
 
-	__l2tp_session_unhash(session);
-	l2tp_session_queue_purge(session);
-	if (session->session_close != NULL)
-		(*session->session_close)(session);
-
-	l2tp_session_dec_refcount(session);
-
+	/* Hold session ref while queued work item is pending */
+	l2tp_session_inc_refcount(session);
+	queue_work(l2tp_wq, &session->del_work);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_delete);
@@ -1783,6 +1797,8 @@  struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
 		INIT_HLIST_NODE(&session->global_hlist);
 		spin_lock_init(&session->lock);
 
+		INIT_WORK(&session->del_work, l2tp_session_del_work);
+
 		/* Inherit debug options from tunnel */
 		session->debug = tunnel->debug;
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 094b2e0dbd75..8a11badb7104 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -123,6 +123,8 @@  struct l2tp_session {
 	struct l2tp_stats	stats;
 	struct hlist_node	global_hlist;	/* Global hash list node */
 
+	struct work_struct	del_work;
+
 	int (*build_header)(struct l2tp_session *session, void *buf);
 	void (*recv_skb)(struct l2tp_session *session, struct sk_buff *skb, int data_len);
 	void (*session_close)(struct l2tp_session *session);