From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-182.mta1.migadu.com (mta1.migadu.com [37.59.57.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB613348463 for ; Fri, 7 Aug 2026 06:02:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=37.59.57.117 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786082538; cv=none; b=FpB44xSKJ/9GU3y2mjn7LPOGWKYrrLey9EB0kNOgD5ne0KowaC5OYeYJWkL7cg5Q3j/zXUQlGJmDts7+BvPBRo3DGro69k1RhFFBztSOv1NFnC40PE7ki3h1WT/NNE8vo72Iw2h1BsGFaULoUxR9Tx0xOeRge91BnhGS1IAaaUA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786082538; c=relaxed/simple; bh=4Pe3fdbiUy56V6BI+59EUtDXrTynQb7K5p4rZeNG4fQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QY7MQkUhfgThjzIOBXvHSvP1lQD1WcCCLqLMBIPU3aVDNQ3W+i4rIAbShX7wS6BGVCGaDRsiYzE1V6ORqN+1kzzex/GAflhdd5Uk7z4xhquAnmYqyJNrRNdBtAMR+depUMR6p9V0oLxMh+d71HilnXw5dT9tcuimvXZyQUaW3Fo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=iH6Prn/b; arc=none smtp.client-ip=37.59.57.117 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="iH6Prn/b" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786082532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=s3sPKaCX17XtWEXBh7qWAvSwR+mehRTWCUCIxQOvnvo=; b=iH6Prn/bfs3c7xTnHOrUTVrGdjQPbWkYbGseSpJDkj8fbePRn0rB47N0fe8DmblNjco4+6 cu1mwEh95g441fKfYGjiH9HarCOpBAD2z0Ykt1bjfUNZVHN3TjRvd4vuoocKPXAkPX3yh/ fZqzBSMFiS7YZPfe6mpkRP7CvMvvG/k= From: Qingfang Deng To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Jonathan Corbet , Shuah Khan , Qingfang Deng , Breno Leitao , netdev@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Paul Mackerras Subject: [PATCH net-next] ppp: update channel locking comment and doc Date: Fri, 7 Aug 2026 14:01:50 +0800 Message-ID: <20260807060153.1380548-1-qingfang.deng@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Commit ec4215683e47 ("ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF") defers freeing generic channel state to an RCU grace period via call_rcu(). Update the SMP locking notes comment in include/linux/ppp_channel.h and Documentation/networking/ppp_generic.rst to reflect that in-flight RCU readers can complete safely after ppp_unregister_channel(). Reported by Sashiko. Signed-off-by: Qingfang Deng --- Documentation/networking/ppp_generic.rst | 11 +++++------ include/linux/ppp_channel.h | 10 +++++----- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/Documentation/networking/ppp_generic.rst b/Documentation/networking/ppp_generic.rst index 5a10abce5964..4c81a0c64fe0 100644 --- a/Documentation/networking/ppp_generic.rst +++ b/Documentation/networking/ppp_generic.rst @@ -213,11 +213,6 @@ The generic layer requires these guarantees from the channel: ppp_register_channel() is called until after the call to ppp_unregister_channel() returns. -* No thread may be in a call to any of ppp_input(), ppp_input_error(), - ppp_output_wakeup(), ppp_channel_index() or ppp_unit_number() for a - channel at the time that ppp_unregister_channel() is called for that - channel. - * ppp_register_channel() and ppp_unregister_channel() must be called from process context, not interrupt or softirq/BH context. @@ -233,6 +228,10 @@ The generic layer requires these guarantees from the channel: The generic layer provides these guarantees to the channels: +* The generic layer defers freeing the generic channel state to an + RCU grace period in ppp_unregister_channel(), allowing in-flight RCU + readers to complete safely. + * The generic layer will not call the start_xmit() function for a channel while any thread is already executing in that function for that channel. @@ -453,4 +452,4 @@ an interface unit are: fragments is disabled. This ioctl is only available if the CONFIG_PPP_MULTILINK option is selected. -Last modified: 7-feb-2002 +Last modified: 7-aug-2026 diff --git a/include/linux/ppp_channel.h b/include/linux/ppp_channel.h index 2f63e9a6cc88..7332e32a448d 100644 --- a/include/linux/ppp_channel.h +++ b/include/linux/ppp_channel.h @@ -79,11 +79,11 @@ extern char *ppp_dev_name(struct ppp_channel *); /* * SMP locking notes: - * The channel code must ensure that when it calls ppp_unregister_channel, - * nothing is executing in any of the procedures above, for that - * channel. The generic layer will ensure that nothing is executing - * in the start_xmit and ioctl routines for the channel by the time - * that ppp_unregister_channel returns. + * ppp_unregister_channel() defers freeing the generic channel state to an + * RCU grace period, allowing in-flight RCU readers to complete safely. + * The generic layer also ensures that no calls to the channel's start_xmit + * or ioctl routines are in progress by the time ppp_unregister_channel() + * returns. */ #endif /* __KERNEL__ */ -- 2.43.0