Re: [PATCH net v2] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Sebastian Andrzej Siewior <[email protected]> Wed, 8 Jul 2026 11:11:47 +0200
| Newsgroups | org.kernel.vger.linux-ppp,org.kernel.vger.linux-kernel,org.kernel.vger.linux-modules,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
On 2026-07-07 09:39:01 [-0700], Paul E. McKenney wrote: > Alternatives include: > > o Provide a patch like that above, but only execute the > rcu_barrier() in some debug mode. If your code works when > that debug is enabled but does not otherwise, you add the > rcu_barrier(). > > o If debug is enabled, make rcu_do_batch() check the function > before invoking it. If the function is not mapped, issue a > diagnostic, and don't try to invoke the function. (But is > there a sufficiently cheap way to check for the function not > being mapped?) In both cases you would see a backtrace and the name of the last unloaded module. And since we don't see a lot of these reports, people either don't run into this because it does not exist or RCU is quick enough. > > Thanx, Paul Sebastian