)]}'
{
  "commit": "d02ba2a6110c530a32926af8ad441111774d2893",
  "tree": "547933c64536511f4e86212fe8a485f270048ab3",
  "parents": [
    "d00fa9adc528c1b0e64d532556764852df8bd7b9"
  ],
  "author": {
    "name": "James Chapman",
    "email": "jchapman@katalix.com",
    "time": "Fri Feb 23 17:45:46 2018 +0000"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Mon Feb 26 12:20:36 2018 -0500"
  },
  "message": "l2tp: fix race in pppol2tp_release with session object destroy\n\npppol2tp_release uses call_rcu to put the final ref on its socket. But\nthe session object doesn\u0027t hold a ref on the session socket so may be\nfreed while the pppol2tp_put_sk RCU callback is scheduled. Fix this by\nhaving the session hold a ref on its socket until the session is\ndestroyed. It is this ref that is dropped via call_rcu.\n\nSessions are also deleted via l2tp_tunnel_closeall. This must now also put\nthe final ref via call_rcu. So move the call_rcu call site into\npppol2tp_session_close so that this happens in both destroy paths. A\ncommon destroy path should really be implemented, perhaps with\nl2tp_tunnel_closeall calling l2tp_session_delete like pppol2tp_release\ndoes, but this will be looked at later.\n\nODEBUG: activate active (active state 1) object type: rcu_head hint:           (null)\nWARNING: CPU: 3 PID: 13407 at lib/debugobjects.c:291 debug_print_object+0x166/0x220\nModules linked in:\nCPU: 3 PID: 13407 Comm: syzbot_19c09769 Not tainted 4.16.0-rc2+ #38\nHardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\nRIP: 0010:debug_print_object+0x166/0x220\nRSP: 0018:ffff880013647a00 EFLAGS: 00010082\nRAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff814d3333\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88001a59f6d0\nRBP: ffff880013647a40 R08: 0000000000000000 R09: 0000000000000001\nR10: ffff8800136479a8 R11: 0000000000000000 R12: 0000000000000001\nR13: ffffffff86161420 R14: ffffffff85648b60 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff88001a580000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020e77000 CR3: 0000000006022000 CR4: 00000000000006e0\nCall Trace:\n debug_object_activate+0x38b/0x530\n ? debug_object_assert_init+0x3b0/0x3b0\n ? __mutex_unlock_slowpath+0x85/0x8b0\n ? pppol2tp_session_destruct+0x110/0x110\n __call_rcu.constprop.66+0x39/0x890\n ? __call_rcu.constprop.66+0x39/0x890\n call_rcu_sched+0x17/0x20\n pppol2tp_release+0x2c7/0x440\n ? fcntl_setlk+0xca0/0xca0\n ? sock_alloc_file+0x340/0x340\n sock_release+0x92/0x1e0\n sock_close+0x1b/0x20\n __fput+0x296/0x6e0\n ____fput+0x1a/0x20\n task_work_run+0x127/0x1a0\n do_exit+0x7f9/0x2ce0\n ? SYSC_connect+0x212/0x310\n ? mm_update_next_owner+0x690/0x690\n ? up_read+0x1f/0x40\n ? __do_page_fault+0x3c8/0xca0\n do_group_exit+0x10d/0x330\n ? do_group_exit+0x330/0x330\n SyS_exit_group+0x22/0x30\n do_syscall_64+0x1e0/0x730\n ? trace_hardirqs_off_thunk+0x1a/0x1c\n entry_SYSCALL_64_after_hwframe+0x42/0xb7\nRIP: 0033:0x7f362e471259\nRSP: 002b:00007ffe389abe08 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f362e471259\nRDX: 00007f362e471259 RSI: 000000000000002e RDI: 0000000000000000\nRBP: 00007ffe389abe30 R08: 0000000000000000 R09: 00007f362e944270\nR10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400b60\nR13: 00007ffe389abf50 R14: 0000000000000000 R15: 0000000000000000\nCode: 8d 3c dd a0 8f 64 85 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7b 48 8b 14 dd a0 8f 64 85 4c 89 f6 48 c7 c7 20 85 64 85 e\n8 2a 55 14 ff \u003c0f\u003e 0b 83 05 ad 2a 68 04 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41\n\nFixes: ee40fb2e1eb5b (\"l2tp: protect sock pointer of struct pppol2tp_session with RCU\")\nSigned-off-by: James Chapman \u003cjchapman@katalix.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2d2955e8f710e20ca9c247c2ec59eedceb1c0883",
      "old_mode": 33188,
      "old_path": "net/l2tp/l2tp_ppp.c",
      "new_id": "3b02f24ea9ec458544109a952f67d8fe69a5fc02",
      "new_mode": 33188,
      "new_path": "net/l2tp/l2tp_ppp.c"
    }
  ]
}