Re: [PATCH net] l2tp: snapshot sequencing state when building transmit headers

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Tue, 13 Oct 2026 17:05:00 +0800 you wrote:
> Updates to send_seq from netlink, PPP setsockopt and receive-side
> negotiation race with packet transmission. The header length is updated
> separately, while transmit reads both fields repeatedly without
> synchronization.
> 
> For example, transmit can push a ten-byte L2TPv2 header, then a concurrent
> writer clears send_seq before the header builder reads it. The builder
> writes only six bytes, leaving four bytes of uninitialized skb headroom
> in the outgoing packet. The reverse mismatch overwrites the beginning of
> the payload. A later hdr_len read can also make the UDP length disagree
> with the skb length.
> 
> [...]

Here is the summary with links:
  - [net] l2tp: snapshot sequencing state when building transmit headers
    https://git.kernel.org/netdev/net/c/d06ae66516e1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html