)]}'
{
  "commit": "e8b9cf5574e8154a6db2505d028682e830c9f620",
  "tree": "a6fb9c6f6e025120085ff62cf3d1185fc0a14d97",
  "parents": [
    "8aeff206767ea83d5b36746e03a4dfc9cec8a6b2"
  ],
  "author": {
    "name": "Guillaume Nault",
    "email": "g.nault@alphalink.fr",
    "time": "Fri Sep 22 15:39:24 2017 +0200"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Mon Apr 13 10:32:51 2020 +0200"
  },
  "message": "l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()\n\ncommit b228a94066406b6c456321d69643b0d7ce11cfa6 upstream.\n\nThere are several ways to remove L2TP sessions:\n\n  * deleting a session explicitly using the netlink interface (with\n    L2TP_CMD_SESSION_DELETE),\n  * deleting the session\u0027s parent tunnel (either by closing the\n    tunnel\u0027s file descriptor or using the netlink interface),\n  * closing the PPPOL2TP file descriptor of a PPP pseudo-wire.\n\nIn some cases, when these methods are used concurrently on the same\nsession, the session can be removed twice, leading to use-after-free\nbugs.\n\nThis patch adds a \u0027dead\u0027 flag, used by l2tp_session_delete() and\nl2tp_tunnel_closeall() to prevent them from stepping on each other\u0027s\ntoes.\n\nThe session deletion path used when closing a PPPOL2TP file descriptor\ndoesn\u0027t need to be adapted. It already has to ensure that a session\nremains valid for the lifetime of its PPPOL2TP file descriptor.\nSo it takes an extra reference on the session in the -\u003esession_close()\ncallback (pppol2tp_session_close()), which is eventually dropped\nin the -\u003esk_destruct() callback of the PPPOL2TP socket\n(pppol2tp_session_destruct()).\nStill, __l2tp_session_unhash() and l2tp_session_queue_purge() can be\ncalled twice and even concurrently for a given session, but thanks to\nproper locking and re-initialisation of list fields, this is not an\nissue.\n\nSigned-off-by: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "394a1ddb07827636ccfb9e517bab328e208d2333",
      "old_mode": 33188,
      "old_path": "net/l2tp/l2tp_core.c",
      "new_id": "7c3da29fad8e186592c1c49f3e2f75495d4d36d1",
      "new_mode": 33188,
      "new_path": "net/l2tp/l2tp_core.c"
    },
    {
      "type": "modify",
      "old_id": "7cc49715606ec2864ca09c5b4f98fe682f406ab6",
      "old_mode": 33188,
      "old_path": "net/l2tp/l2tp_core.h",
      "new_id": "7c2037184b6c7d63c58239db32d899f8cf5a41dd",
      "new_mode": 33188,
      "new_path": "net/l2tp/l2tp_core.h"
    }
  ]
}