[PATCH net-next] ppp: update channel locking comment and doc
From: Qingfang Deng <hidden>
Date: 2026-08-07 06:02:24
Commit ec4215683e47 ("ppp: defer channel free to an RCU grace period to
fix pppol2tp RX UAF") defers freeing generic channel state to an RCU
grace period via call_rcu().
Update the SMP locking notes comment in include/linux/ppp_channel.h and
Documentation/networking/ppp_generic.rst to reflect that in-flight RCU
readers can complete safely after ppp_unregister_channel().
Reported by Sashiko.
Signed-off-by: Qingfang Deng <redacted>
---
Documentation/networking/ppp_generic.rst | 11 +++++------
include/linux/ppp_channel.h | 10 +++++-----
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/Documentation/networking/ppp_generic.rst b/Documentation/networking/ppp_generic.rst
index 5a10abce5964..4c81a0c64fe0 100644
--- a/Documentation/networking/ppp_generic.rst
+++ b/Documentation/networking/ppp_generic.rst@@ -213,11 +213,6 @@ The generic layer requires these guarantees from the channel: ppp_register_channel() is called until after the call to ppp_unregister_channel() returns. -* No thread may be in a call to any of ppp_input(), ppp_input_error(), - ppp_output_wakeup(), ppp_channel_index() or ppp_unit_number() for a - channel at the time that ppp_unregister_channel() is called for that - channel. - * ppp_register_channel() and ppp_unregister_channel() must be called from process context, not interrupt or softirq/BH context.
@@ -233,6 +228,10 @@ The generic layer requires these guarantees from the channel: The generic layer provides these guarantees to the channels: +* The generic layer defers freeing the generic channel state to an + RCU grace period in ppp_unregister_channel(), allowing in-flight RCU + readers to complete safely. + * The generic layer will not call the start_xmit() function for a channel while any thread is already executing in that function for that channel.
@@ -453,4 +452,4 @@ an interface unit are: fragments is disabled. This ioctl is only available if the CONFIG_PPP_MULTILINK option is selected. -Last modified: 7-feb-2002 +Last modified: 7-aug-2026
diff --git a/include/linux/ppp_channel.h b/include/linux/ppp_channel.h
index 2f63e9a6cc88..7332e32a448d 100644
--- a/include/linux/ppp_channel.h
+++ b/include/linux/ppp_channel.h@@ -79,11 +79,11 @@ extern char *ppp_dev_name(struct ppp_channel *); /* * SMP locking notes: - * The channel code must ensure that when it calls ppp_unregister_channel, - * nothing is executing in any of the procedures above, for that - * channel. The generic layer will ensure that nothing is executing - * in the start_xmit and ioctl routines for the channel by the time - * that ppp_unregister_channel returns. + * ppp_unregister_channel() defers freeing the generic channel state to an + * RCU grace period, allowing in-flight RCU readers to complete safely. + * The generic layer also ensures that no calls to the channel's start_xmit + * or ioctl routines are in progress by the time ppp_unregister_channel() + * returns. */ #endif /* __KERNEL__ */
--
2.43.0