Re: [PATCH v2 net-next 9/9] l2tp: flush workqueue before draining it

[Cong Wang <xiyou.wangcong@gmail.com>]

On Wed, Aug 07, 2024 at 07:54:52AM +0100, James Chapman wrote:
> syzbot exposes a race where a net used by l2tp is removed while an
> existing pppol2tp socket is closed. In l2tp_pre_exit_net, l2tp queues
> TUNNEL_DELETE work items to close each tunnel in the net. When these
> are run, new SESSION_DELETE work items are queued to delete each
> session in the tunnel. This all happens in drain_workqueue. However,
> drain_workqueue allows only new work items if they are queued by other
> work items which are already in the queue. If pppol2tp_release runs
> after drain_workqueue has started, it may queue a SESSION_DELETE work
> item, which results in the warning below in drain_workqueue.
> 
> Address this by flushing the workqueue before drain_workqueue such
> that all queued TUNNEL_DELETE work items run before drain_workqueue is
> started. This will queue SESSION_DELETE work items for each session in
> the tunnel, hence pppol2tp_release or other API requests won't queue
> SESSION_DELETE requests once drain_workqueue is started.
> 

I am not convinced here.

1) There is a __flush_workqueue() inside drain_workqueue() too. Why
calling it again?

2) What prevents new work items be queued right between your
__flush_workqueue() and drain_workqueue()?

Thanks.