Subject: Re: [Patch net 2/2] l2tp: close all race conditions in l2tp_tunnel_register()

From: Saeed Mahameed <[email-masked]>
Date: Sat, 7 Jan 2023 10:41:41 -0800

On 05 Jan 11:13, Cong Wang wrote:
>From: Cong Wang <[email-masked]>
>
>The code in l2tp_tunnel_register() is racy in several ways:
>
>1. It modifies the tunnel socket _after_ publishing it.
>
>2. It calls setup_udp_tunnel_sock() on an existing socket without
>   locking.
>
>3. It changes sock lock class on fly, which triggers many syzbot
>   reports.
>
>This patch amends all of them by moving socket initialization code
>before publishing and under sock lock. As suggested by Jakub, the
>l2tp lockdep class is not necessary as we can just switch to
>bh_lock_sock_nested().
>
>Fixes: 37159ef2c1ae ("l2tp: fix a lockdep splat")
>Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation")

This patch relies on the previous one which doesn't include any tags.
If you are interested in this making it to -stable then maybe you need to
add those tags to the previous commit ?

I am not really familiar with the issue and how socket locks should work
here, but code wise LGTM.

Reviewed-by: Saeed Mahameed <[email-masked]>

>Reported-by: [email-masked]
>Reported-by: [email-masked]
>Reported-by: Tetsuo Handa <[email-masked]>
>Cc: Guillaume Nault <[email-masked]>
>Cc: Jakub Sitnicki <[email-masked]>
>Cc: Eric Dumazet <[email-masked]>
>Signed-off-by: Cong Wang <[email-masked]>