[PATCH] l2tp: fix warning in l2tp_exit_net found by syzbot
From: James Chapman
Date: Wed Nov 06 2024 - 11:04:44 EST
l2tp uses idr_is_empty to check that its IDRs are empty in its net
exit handler before calling idr_destroy and warns if the IDR isn't
empty. syzbot is able to hit this warning by injecting a memory
allocation fail inside idr_alloc_u32 (radix_tree_node_alloc). However,
this leaves the IDR root with its IDR_FREE tag unset such that the IDR
appears non-empty to idr_is_empty callers.
Fix this in l2tp by checking that the IDR is empty using idr_for_each
instead of idr_is_empty.
Reported-by: syzbot+332fe1e67018625f63c9@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 73d33bd063c4c ("l2tp: avoid using drain_workqueue in l2tp_pre_exit_net")
---
net/l2tp/l2tp_core.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 3eec23ac5ab1..a665bdf3f9c6 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1870,15 +1870,26 @@ static __net_exit void l2tp_pre_exit_net(struct net *net)
}
}
+static int l2tp_idr_item_unexpected(int id, void *p, void *data)
+{
+ const char *idr_name = data;
+ pr_err("IDR %s not empty\n", idr_name);
+ WARN_ON_ONCE(1);
+ return 1;
+}
+
static __net_exit void l2tp_exit_net(struct net *net)
{
struct l2tp_net *pn = l2tp_pernet(net);
- WARN_ON_ONCE(!idr_is_empty(&pn->l2tp_v2_session_idr));
+ rcu_read_lock_bh();
+ idr_for_each(&pn->l2tp_v2_session_idr, l2tp_idr_item_unexpected, "v2_session");
+ idr_for_each(&pn->l2tp_v3_session_idr, l2tp_idr_item_unexpected, "v3_session");
+ idr_for_each(&pn->l2tp_tunnel_idr, l2tp_idr_item_unexpected, "tunnel");
+ rcu_read_unlock_bh();
+
idr_destroy(&pn->l2tp_v2_session_idr);
- WARN_ON_ONCE(!idr_is_empty(&pn->l2tp_v3_session_idr));
idr_destroy(&pn->l2tp_v3_session_idr);
- WARN_ON_ONCE(!idr_is_empty(&pn->l2tp_tunnel_idr));
idr_destroy(&pn->l2tp_tunnel_idr);
}
--
2.34.1