From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590049; b=i6rEWV3K44O/4uU+yN2ClBq+Ate+iNATf0iHlPIH5pSYqKldvXZbyN97MV58E7oqwc3H M+M/e2ZW1hXHdI/d01i2mo5RfReSfOAVOOSUzUWFOnrfscRI7pCBlNiK8c7RWm/qltpHc VILORaGnY6L5BGX+lTnO+HaxY2e93o0eIol3WTUUgH37RQ1fHPugz3hlUOkOH/vntNBTi qc85raH64aXRhilv8WVV2kJUvFU7vbPF2QpgGLR3g5vE55w5e3RwlzeZ7dErPFO2B1uSE ReYEuxPTYnaN4FshnCIvtpmctXCiTyGRPmrCDy7fHzZ42IXVhaM//vyVbWQE6kUxiUQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590049; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=CycX1FxIWWOn1iId5gpA4YNTRNT/KyiqrlWd360Lcc0=; b=H8lWPme4pezSmw6Oiva8oADPa3Qtf+lj20y0LmEuYLZ9QWG0SnHrWOD5EXY0Jy9H/KT9 sGDkRf5uUY2NxirQHQ7Uxp2ewPK0BqSBHe7bvPmWyDfnb44tnJCjyFZ+vYPg+gwkzVABx H3cnfRlDKGq3rDmwrKAPueGRWmwi5GE6dDbYb4VXUheS9+lcyYG5b9ixlxFz0g7osyFNb s2bb43atfD/QwNqtFyrsD/RbknuxOjhUsVZja7nu7YGLPAe7jSXQL01wwsMCjpEWOioG3 f2tKbJoQgyxJrOl8UTtf3yKQdvztunwN4qUh0PEIv1KWr5gaFuIUhwXQbYl7xd60EBA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ecGrcsoY; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BEFF1606A336; Fri, 13 Nov 2026 17:14:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ecGrcsoY Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B98A1F000C4; Fri, 13 Nov 2026 17:14:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590049; bh=CycX1FxIWWOn1iId5gpA4YNTRNT/KyiqrlWd360Lcc0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ecGrcsoY6P45wFbroHj0X9t4puEz2dOmPSGWbAPq35efeuAoVThtwOOnts+03llD7 CzzU6b2pYanc9ykgHmVto7GOeTP+g9z+4SmfyrVbX3sKgSpe+GDnlTzdc0PjYLL1Gr eTNgPYLmoHVaK2iollUaWWdFc14T6i0vXvRSMXBI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Qingfang Deng , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.18 083/686] pppoe: delete session hash entries by pointer match Date: Fri, 13 Nov 2026 10:43:36 -0500 Message-ID: <20261113153823.696171586@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Qingfang Deng [ Upstream commit b5b8c81836e2bec7b444dfa2b14fd14e912e9d63 ] pppoe_connect() copies the requested PPPoE address to a socket before attempting to insert the socket into the session hash table. If the tuple already exists, __set_item() returns -EALREADY, but the copied address and ifindex remain set on the failed socket. Closing that socket then deletes the existing socket's hash entry through pppoe_release(), preventing it from receiving further session traffic. An unprivileged process in the same network namespace can trigger this through a duplicate connection attempt. To avoid the accidental delete, pass the pppox_sock to __delete_item(), and unlink only an entry whose pointer matches the requested socket. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20261020092118.47416-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski [ Resolve conflict, and remove const qualifier of pppox_sock to match hash_item(). ] Signed-off-by: Qingfang Deng Signed-off-by: Sasha Levin --- drivers/net/ppp/pppoe.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c index 7ee63051a1619..0bfb048c291a3 100644 --- a/drivers/net/ppp/pppoe.c +++ b/drivers/net/ppp/pppoe.c @@ -195,18 +195,16 @@ static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) return 0; } -static void __delete_item(struct pppoe_net *pn, __be16 sid, - char *addr, int ifindex) +static void __delete_item(struct pppoe_net *pn, struct pppox_sock *po) { - int hash = hash_item(sid, addr); + int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); struct pppox_sock *ret, __rcu **src; ret = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); src = &pn->hash_table[hash]; while (ret) { - if (cmp_addr(&ret->pppoe_pa, sid, addr) && - ret->pppoe_ifindex == ifindex) { + if (ret == po) { struct pppox_sock *next; next = rcu_dereference_protected(ret->next, @@ -256,11 +254,10 @@ static inline struct pppox_sock *__get_item_by_addr(struct net *net, return pppox_sock; } -static inline void delete_item(struct pppoe_net *pn, __be16 sid, - char *addr, int ifindex) +static void delete_item(struct pppoe_net *pn, struct pppox_sock *po) { spin_lock(&pn->hash_lock); - __delete_item(pn, sid, addr, ifindex); + __delete_item(pn, po); spin_unlock(&pn->hash_lock); } @@ -602,8 +599,7 @@ static int pppoe_release(struct socket *sock) * protect "po" from concurrent updates * on pppoe_flush_dev */ - delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, - po->pppoe_ifindex); + delete_item(pn, po); sock_orphan(sk); sock->sk = NULL; @@ -653,8 +649,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, if (stage_session(po->pppoe_pa.sid)) { pppox_unbind_sock(sk); pn = pppoe_pernet(sock_net(sk)); - delete_item(pn, po->pppoe_pa.sid, - po->pppoe_pa.remote, po->pppoe_ifindex); + delete_item(pn, po); if (po->pppoe_dev) { dev_put(po->pppoe_dev); po->pppoe_dev = NULL; @@ -705,8 +700,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, error = ppp_register_net_channel(dev_net(dev), &po->chan); if (error) { - delete_item(pn, po->pppoe_pa.sid, - po->pppoe_pa.remote, po->pppoe_ifindex); + delete_item(pn, po); goto err_put; } -- 2.53.0