Hi Greg,
Syzbot has been complaining about KASAN splats due to use-after-free issues in the l2tp code on 4.4 Android kernels (although I reproduced with latest 4.4 stable on my laptop):
https://syzkaller.appspot.com/bug?id=de316389db0fa0cd7ced6e564601ea8e56625eb...
These have been fixed upstream, but for some reason didn't get picked up for stable. This series applies to 4.4.y and I've sent patches for 4.9 separately.
Thanks,
Will
--->8
Gao Feng (1): l2tp: Refactor the codes with existing macros instead of literal number
Guillaume Nault (5): l2tp: fix race in l2tp_recv_common() l2tp: ensure session can't get removed during pppol2tp_session_ioctl() l2tp: fix duplicate session creation l2tp: ensure sessions are freed after their PPPOL2TP socket l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()
Shmulik Ladkani (1): net: l2tp: Make l2tp_ip6 namespace aware
phil.turnbull@oracle.com (1): l2tp: Correctly return -EBADF from pppol2tp_getname.
net/l2tp/l2tp_core.c | 149 ++++++++++++++++++++++++++++++++++--------- net/l2tp/l2tp_core.h | 4 ++ net/l2tp/l2tp_eth.c | 10 +-- net/l2tp/l2tp_ip.c | 17 +++-- net/l2tp/l2tp_ip6.c | 28 +++++--- net/l2tp/l2tp_ppp.c | 110 ++++++++++++++++---------------- 6 files changed, 211 insertions(+), 107 deletions(-)