Re: [PATCH net v2] l2tp: only return sessions of the given tunnel in l2tp_session_get()

[Guillaume Nault]

On Thu, Oct 29, 2026 at 11:26:17PM -0400, Hengyu Liang wrote:
> Commit 5f77c18ea556 ("l2tp: use IDR for all session lookups") made
> pppol2tp_connect() and the netlink session commands find sessions with
> l2tp_session_get(), passing the socket of the tunnel they name.
> 
> L2TPv3 session IDs are unique per network namespace, except that
> sessions carried over UDP are only unique per UDP socket, the socket of
> their tunnel. However, l2tp_v3_session_get() only checks the socket when
> another session has the same session ID. Otherwise it returns the
> session, whichever tunnel it belongs to. As of now, a session command
> that names the wrong tunnel acts on a session of another tunnel, and a
> PPPoL2TP socket for a second L2TPv3 tunnel fails with EEXIST, because it
> finds session 0 of the first tunnel.
> 
> The issue can be reproduced with:
> 
>     ip l2tp add tunnel tunnel_id 3 peer_tunnel_id 3 encap udp \
>         local 127.0.0.1 remote 127.0.0.1 udp_sport 5003 udp_dport 6003
>     ip l2tp add tunnel tunnel_id 4 peer_tunnel_id 4 encap udp \
>         local 127.0.0.1 remote 127.0.0.1 udp_sport 5004 udp_dport 6004
>     ip l2tp add session tunnel_id 3 session_id 7 peer_session_id 7
>     ip l2tp del session tunnel_id 4 session_id 7
>     ip l2tp show session
> 
> Before that commit, the delete fails with "No such device", and session
> 7 of tunnel 3 is still listed. After that commit, the delete succeeds,
> and session 7 of tunnel 3 is gone.
> 
> This patch will make l2tp_session_get() return NULL when the L2TPv3
> session it finds does not belong to the given socket. The receive path
> calls l2tp_v3_session_get() directly and is not changed.
> 

Acked-by: Guillaume Nault <gnault@xxxxxxxxxx>