[lvc-project] [PATCH net-next v9] l2tp: fix double dst_release() on sk_dst_cache race

[Paolo Abeni]

On 6/1/26 11:33 PM, Mikhail Lobanov wrote:
> +static int l2tp_xmit_ipv4(struct sock *sk, struct sk_buff *skb, struct flowi *fl)
> +{
> +	struct inet_sock *inet = inet_sk(sk);
> +	struct net *net = sock_net(sk);
> +	struct ip_options_rcu *inet_opt;

Since a repost is needed, please additionaly fix the variable
declaration order above ...

> +	struct flowi4 *fl4;
> +	struct rtable *rt;
> +	__u8 tos;
> +	int err;
> +
> +	rcu_read_lock();
> +	inet_opt = rcu_dereference(inet->inet_opt);
> +	fl4 = &fl->u.ip4;
> +	tos = READ_ONCE(inet->tos);
> +
> +	rt = dst_rtable(sk_dst_check(sk, 0));
> +	if (!rt) {
> +		__be32 daddr = inet->inet_daddr;
> +
> +		if (inet_opt && inet_opt->opt.srr)
> +			daddr = inet_opt->opt.faddr;
> +
> +		rt = ip_route_output_ports(net, fl4, sk,
> +					   daddr, inet->inet_saddr,
> +					   inet->inet_dport,
> +					   inet->inet_sport,
> +					   sk->sk_protocol,
> +					   tos & INET_DSCP_MASK,
> +					   READ_ONCE(sk->sk_bound_dev_if));
> +		if (IS_ERR(rt)) {
> +			rcu_read_unlock();
> +			IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
> +			kfree_skb_reason(skb, SKB_DROP_REASON_IP_OUTNOROUTES);
> +			return -EHOSTUNREACH;
> +		}
> +
> +		sk_setup_caps(sk, &rt->dst);
> +	}
> +
> +	skb_dst_set_noref(skb, &rt->dst);
> +	rcu_read_unlock();
> +
> +	err = ip_queue_xmit(sk, skb, fl);
> +	return err;
> +}
> +
>  /* Queue the packet to IP for output: tunnel socket lock must be held */
>  static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl)
>  {
>  	int err;
> +	struct sock *sk = tunnel->sock;

... and here, too.

Thanks,

Paolo