[src/trunk]: src/sys/net fix potentially use after free between "ifconfig l2t...

[knakahara <knakahara%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d974f48ea6b5
branches:  trunk
changeset: 822729:d974f48ea6b5
user:      knakahara <knakahara%NetBSD.org@localhost>
date:      Mon Apr 03 10:08:24 2017 +0000

description:
fix potentially use after free between "ifconfig l2tpX destroy" and l2tp Tx.

It is protected by KERNEL_LOCK in soo_ioctl() between "ioctl destory" and
other ioctls. And, it is protected by encap_lock() between "ioctl destroy"
and Rx. However, it was not protected between "ioctl destroy" and Tx.
That is,
    + CPU#A
      - do "ifconfig l2tpX destroy"
        - call l2tp_clone_destroy()
        - done l2tp_delete_tunnel()
    + CPU#B
      - begin l2tp output processing
        - call l2tp_transmit()
        - done l2tp_getref_variant()
    + CPU#A
        - done kmem_free(sc->l2tp_var, )
    + CPU#B
        - access to sc->l2tp_var after free

pointed out by s-yamaguchi@IIJ, thanks.

diffstat:

 sys/net/if_l2tp.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r ede074108d13 -r d974f48ea6b5 sys/net/if_l2tp.c
--- a/sys/net/if_l2tp.c Mon Apr 03 09:37:58 2017 +0000
+++ b/sys/net/if_l2tp.c Mon Apr 03 10:08:24 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_l2tp.c,v 1.2 2017/03/30 06:42:05 knakahara Exp $    */
+/*     $NetBSD: if_l2tp.c,v 1.3 2017/04/03 10:08:24 knakahara Exp $    */
 
 /*
  * Copyright (c) 2017 Internet Initiative Japan Inc.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_l2tp.c,v 1.2 2017/03/30 06:42:05 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_l2tp.c,v 1.3 2017/04/03 10:08:24 knakahara Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -301,6 +301,12 @@
 
        l2tp_clear_session(sc);
        l2tp_delete_tunnel(&sc->l2tp_ec.ec_if);
+       /*
+        * To avoid for l2tp_transmit() to access sc->l2tp_var after free it.
+        */
+       mutex_enter(&sc->l2tp_lock);
+       l2tp_variant_update(sc, NULL);
+       mutex_exit(&sc->l2tp_lock);
 
        mutex_enter(&l2tp_softcs.lock);
        LIST_REMOVE(sc, l2tp_list);