linux/drivers/net/ppp
Xin Long 9417d81f4f pptp: dst_release sk_dst_cache in pptp_sock_destruct
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
otherwise, the dst refcnt will leak.

It can be reproduced by this syz log:

  r1 = socket$pptp(0x18, 0x1, 0x2)
  bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
  connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)

Consecutive dmesg warnings will occur:

  unregister_netdevice: waiting for lo to become free. Usage count = 1

v1->v2:
  - use rcu_dereference_protected() instead of rcu_dereference_check(),
    as suggested by Eric.

Fixes: 00959ade36 ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-13 14:22:49 -07:00
..
bsd_comp.c treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
Kconfig tty/serial patches for 3.9-rc1 2013-02-21 13:41:04 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ppp_async.c ppp: Move PFC decompression to PPP generic layer 2018-12-20 16:49:30 -08:00
ppp_deflate.c ppp: deflate: never return len larger than output buffer 2015-01-29 14:50:01 -08:00
ppp_generic.c ppp: Move PFC decompression to PPP generic layer 2018-12-20 16:49:30 -08:00
ppp_mppe.c ppp: mppe: Remove VLA usage of skcipher 2018-09-28 12:46:07 +08:00
ppp_mppe.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ppp_synctty.c ppp: Move PFC decompression to PPP generic layer 2018-12-20 16:49:30 -08:00
pppoe.c net: Fix usage of pskb_trim_rcsum 2019-01-18 14:05:14 -08:00
pppox.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
pptp.c pptp: dst_release sk_dst_cache in pptp_sock_destruct 2019-03-13 14:22:49 -07:00