Module Name: src
Committed By: knakahara
Date: Mon Apr 3 10:08:24 UTC 2017
Modified Files:
src/sys/net: if_l2tp.c
Log Message:
fix potentially use after free between "ifconfig l2tpX destroy" and l2tp Tx.
It is protected by KERNEL_LOCK in soo_ioctl() between "ioctl destory" and
other ioctls. And, it is protected by encap_lock() between "ioctl destroy"
and Rx. However, it was not protected between "ioctl destroy" and Tx.
That is,
+ CPU#A
- do "ifconfig l2tpX destroy"
- call l2tp_clone_destroy()
- done l2tp_delete_tunnel()
+ CPU#B
- begin l2tp output processing
- call l2tp_transmit()
- done l2tp_getref_variant()
+ CPU#A
- done kmem_free(sc->l2tp_var, )
+ CPU#B
- access to sc->l2tp_var after free
pointed out by s-yamaguchi@IIJ, thanks.
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/sys/net/if_l2tp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_l2tp.c
diff -u src/sys/net/if_l2tp.c:1.2 src/sys/net/if_l2tp.c:1.3
--- src/sys/net/if_l2tp.c:1.2 Thu Mar 30 06:42:05 2017
+++ src/sys/net/if_l2tp.c Mon Apr 3 10:08:24 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: if_l2tp.c,v 1.2 2017/03/30 06:42:05 knakahara Exp $ */
+/* $NetBSD: if_l2tp.c,v 1.3 2017/04/03 10:08:24 knakahara Exp $ */
/*
* Copyright (c) 2017 Internet Initiative Japan Inc.
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_l2tp.c,v 1.2 2017/03/30 06:42:05 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_l2tp.c,v 1.3 2017/04/03 10:08:24 knakahara Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -301,6 +301,12 @@ l2tp_clone_destroy(struct ifnet *ifp)
l2tp_clear_session(sc);
l2tp_delete_tunnel(&sc->l2tp_ec.ec_if);
+ /*
+ * To avoid for l2tp_transmit() to access sc->l2tp_var after free it.
+ */
+ mutex_enter(&sc->l2tp_lock);
+ l2tp_variant_update(sc, NULL);
+ mutex_exit(&sc->l2tp_lock);
mutex_enter(&l2tp_softcs.lock);
LIST_REMOVE(sc, l2tp_list);
