Re: [PATCH net v2] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
From: Qingfang Deng <hidden>
Date: 2026-07-05 02:58:13
Also in:
lkml
On 7/4/2026 at 12:32 AM, Breno Leitao wrote:
On Fri, Jul 03, 2026 at 03:27:00PM +0800, Qingfang Deng wrote:quoted
AI-review found an issue: https://sashiko.dev/#/patchset/D9C0245B-608B-4884-8A09-F55BA4A9F948%40doyensec.com An rcu_barrier() call is needed at the end of ppp_cleanup().I was initially unclear why rcu_barrier() would be necessary on a kfree path, but it appears to be required during module unload to ensure that ppp_release_channel_free() completes before the module's struct rcu_head is destroyed. Is that the correct understanding?
It's required to ensure that all ppp_release_channel_free() callback complete before the text segment of the module is unloaded.