[PATCH 0/8] [backports] l2tp use-after-free fixes for 4.4 stable

[Will Deacon]

Hi Greg,

Syzbot has been complaining about KASAN splats due to use-after-free
issues in the l2tp code on 4.4 Android kernels (although I reproduced
with latest 4.4 stable on my laptop):

https://syzkaller.appspot.com/bug?id=de316389db0fa0cd7ced6e564601ea8e56625ebc

These have been fixed upstream, but for some reason didn't get picked up
for stable. This series applies to 4.4.y and I've sent patches for 4.9
separately.

Thanks,

Will

--->8


Gao Feng (1):
  l2tp: Refactor the codes with existing macros instead of literal
    number

Guillaume Nault (5):
  l2tp: fix race in l2tp_recv_common()
  l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
  l2tp: fix duplicate session creation
  l2tp: ensure sessions are freed after their PPPOL2TP socket
  l2tp: fix race between l2tp_session_delete() and
    l2tp_tunnel_closeall()

Shmulik Ladkani (1):
  net: l2tp: Make l2tp_ip6 namespace aware

phil.turnbull@xxxxxxxxxx (1):
  l2tp: Correctly return -EBADF from pppol2tp_getname.

 net/l2tp/l2tp_core.c | 149 ++++++++++++++++++++++++++++++++++---------
 net/l2tp/l2tp_core.h |   4 ++
 net/l2tp/l2tp_eth.c  |  10 +--
 net/l2tp/l2tp_ip.c   |  17 +++--
 net/l2tp/l2tp_ip6.c  |  28 +++++---
 net/l2tp/l2tp_ppp.c  | 110 ++++++++++++++++----------------
 6 files changed, 211 insertions(+), 107 deletions(-)

-- 
2.26.0.rc2.310.g2932bb562d-goog