From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-182.mta1.migadu.com (out-182.mta1.migadu.com [95.215.58.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 857FB36405F for ; Fri, 10 Apr 2026 09:39:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775813972; cv=none; b=M6sgFs2IFaADEjAb7eyJyzczQ4hhFAObo+rqLiIEdVtU5366VfKoPfp/aShDhJWBj+jsH5L32cepNhnoX2QGYGyN025wIOfd79qeDT0yvpUHirYSlf9Mk2mpg2zmfxTPnbrP4ILWwl0rokztr+i+jz+bbi0ZdqHRq7A5Vh07PZM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775813972; c=relaxed/simple; bh=RIn5QS+/wQzlvfqGGsGZEx3uU16qwFy1NVNMP3oy5CU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QrdgAT+u3zYz7alc4DBCZbWv5YKxLv1bqZKp4a0Lxb+wbehgTVxBSiZzNb3KVT+yJ60Z8cGjRSoGRuKw7jwjAk49UuvBQqnckmLbsC6fPJjm4LT7sVWurTZcuvik+iuzi7avdfq1B3ytIriRHD0v/wKNKu+KP86ZWgyn/5NZZNU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=CVlOo5SW; arc=none smtp.client-ip=95.215.58.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="CVlOo5SW" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1775813958; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=KbAA0jl9JOczfY3YunY2afV3MXW4kTf45LXLhHaMhow=; b=CVlOo5SWqqQx7F2ZN43SJCcEADQBbMBgQHw26nF2uyWU6VxP4NPGDgicWOVQhv2MiEde3P +46PUZYEAxnijpTgN8n6L6uFOvPtetciQEe0ho7G2SpyVqMKa6enBOz93g1SpLJa/xTUhV A3QkgtD7NbOyPbNglrKZFpW8G5Y1sxA= From: Qingfang Deng To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Qingfang Deng , Yue Haibing , Kuniyuki Iwashima , Kees Cook , Sebastian Andrzej Siewior , linux-ppp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Tom Parkin , James Chapman , Guillaume Nault Subject: [PATCH net-next] ppp: tear down bridge before clearing pch->chan Date: Fri, 10 Apr 2026 17:38:56 +0800 Message-ID: <20260410093859.69237-1-qingfang.deng@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT As we previously did to ppp_disconnect_channel(), also move ppp_unbridge_channels() before pch->chan is set to NULL in ppp_unregister_channel(). ppp_unbridge_channels() calls synchronize_rcu(), so no concurrent RCU readers in ppp_channel_bridge_input() can observe the channel after its chan pointer is cleared. This makes the !pchb->chan check in ppp_channel_bridge_input() redundant and can be safely removed. Signed-off-by: Qingfang Deng --- drivers/net/ppp/ppp_generic.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index b097d1b38ac9..3a609d48a424 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -2285,17 +2285,11 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb) goto out_rcu; spin_lock_bh(&pchb->downl); - if (!pchb->chan) { - /* channel got unregistered */ - kfree_skb(skb); - goto outl; - } skb_scrub_packet(skb, !net_eq(pch->chan_net, pchb->chan_net)); if (!pchb->chan->ops->start_xmit(pchb->chan, skb)) kfree_skb(skb); -outl: spin_unlock_bh(&pchb->downl); out_rcu: rcu_read_unlock(); @@ -2997,6 +2991,8 @@ ppp_unregister_channel(struct ppp_channel *chan) * the channel's start_xmit or ioctl routine before we proceed. */ ppp_disconnect_channel(pch); + ppp_unbridge_channels(pch); + down_write(&pch->chan_sem); spin_lock_bh(&pch->downl); pch->chan = NULL; @@ -3008,8 +3004,6 @@ ppp_unregister_channel(struct ppp_channel *chan) list_del(&pch->list); spin_unlock_bh(&pn->all_channels_lock); - ppp_unbridge_channels(pch); - pch->file.dead = 1; wake_up_interruptible(&pch->file.rwait); -- 2.43.0