Re: [PATCH net v3] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

[email protected] Fri, 10 Jul 2026 11:40:10 +0000

Newsgroups	org.kernel.vger.linux-ppp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID	<178368361038.197766.8115253096775560860.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <[email protected]>:

On Mon, 6 Jul 2026 11:01:59 +0200 you wrote:
> pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
> 
>  l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
>    -> ppp_input(&po->chan)
> 
> It runs under rcu_read_lock() holding only an l2tp_session reference and
> takes NO reference on the internal PPP channel (struct channel,
> chan->ppp) that ppp_input() dereferences.
> 
> [...]

Here is the summary with links:
  - [net,v3] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
    https://git.kernel.org/netdev/net/c/ec4215683e47

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html