Re: [PATCH net] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

On Jul 1, 2026, at 15:15, Breno Leitao [off-list ref] wrote:

On Wed, Jul 01, 2026 at 02:14:39PM +0200, Norbert Szetei wrote:

quoted

diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 57c68efa5ff8..cb8fe37170d3 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c

@@ -184,6 +184,7 @@ struct channel {

struct list_head clist; /* link in list of channels per unit */
spinlock_t upl; /* protects `ppp' and 'bridge' */
struct channel __rcu *bridge; /* "bridged" ppp channel */
+ struct rcu_head rcu; /* for RCU-deferred free of the channel */
#ifdef CONFIG_PPP_MULTILINK
u8 avail; /* flag used in multilink stuff */
u8 had_frag; /* >= 1 fragments have been sent */

@@ -3583,7 +3584,7 @@ static void ppp_release_channel(struct channel *pch)

}
skb_queue_purge(&pch->file.xq);
skb_queue_purge(&pch->file.rq);
- kfree(pch);
+ kfree_rcu(pch, rcu);

Why not use kfree_rcu_mightsleep() instead? That would eliminate the need
for the additional `struct rcu_head rcu;` field.

You are right, kfree_rcu_mightsleep() would be simpler, but it's
free-only. No callback to run the deferred purge, it can't handle the
in-flight skb. So, I'll keep the rcu_head and use call_rcu() in v2.