From: Guillaume Nault <gnault@redhat.com>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
netdev@vger.kernel.org, eric.dumazet@gmail.com,
syzbot+7312e82745f7fa2526db@syzkaller.appspotmail.com,
James Chapman <jchapman@katalix.com>
Subject: Re: [PATCH net] l2tp: avoid one data-race in l2tp_tunnel_del_work()
Date: Thu, 15 Jan 2026 11:59:39 +0100 [thread overview]
Message-ID: <aWjIm9SDLjHztAT-@debian> (raw)
In-Reply-To: <20260115092139.3066180-1-edumazet@google.com>
On Thu, Jan 15, 2026 at 09:21:39AM +0000, Eric Dumazet wrote:
> We should read sk->sk_socket only when dealing with kernel sockets.
>
> syzbot reported the following data-race:
>
> BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
>
> write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:
> sk_set_socket include/net/sock.h:2092 [inline]
> sock_orphan include/net/sock.h:2118 [inline]
> sk_common_release+0xae/0x230 net/core/sock.c:4003
> udp_lib_close+0x15/0x20 include/net/udp.h:325
> inet_release+0xce/0xf0 net/ipv4/af_inet.c:437
> __sock_release net/socket.c:662 [inline]
> sock_close+0x6b/0x150 net/socket.c:1455
> __fput+0x29b/0x650 fs/file_table.c:468
> ____fput+0x1c/0x30 fs/file_table.c:496
> task_work_run+0x131/0x1a0 kernel/task_work.c:233
> resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
> __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
> exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75
> __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
> syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
> syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
> syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
> do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:
> l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418
> process_one_work kernel/workqueue.c:3257 [inline]
> process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
> worker_thread+0x582/0x770 kernel/workqueue.c:3421
> kthread+0x489/0x510 kernel/kthread.c:463
> ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
>
> value changed: 0xffff88811b818000 -> 0x0000000000000000
>
> Fixes: d00fa9adc528 ("l2tp: fix races with tunnel socket close")
Reviewed-by: Guillaume Nault <gnault@redhat.com>
next prev parent reply other threads:[~2026-01-15 10:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-15 9:21 [PATCH net] l2tp: avoid one data-race in l2tp_tunnel_del_work() Eric Dumazet
2026-01-15 10:59 ` Guillaume Nault [this message]
2026-01-19 18:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aWjIm9SDLjHztAT-@debian \
--to=gnault@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=horms@kernel.org \
--cc=jchapman@katalix.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+7312e82745f7fa2526db@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox