diff options
| author | Xin Long <lucien.xin@gmail.com> | 2019-03-13 17:00:48 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-07-09 22:04:18 +0100 |
| commit | fd59cd035b3a0474e6a207f225798f4165773d83 (patch) | |
| tree | feac7d30925f42113bdbc31bdcb539779c23e411 | |
| parent | 0e96f139f6f86a3d5cb6b5b1a912866e24131f48 (diff) | |
| download | linux-stable-fd59cd035b3a0474e6a207f225798f4165773d83.tar.gz linux-stable-fd59cd035b3a0474e6a207f225798f4165773d83.tar.bz2 linux-stable-fd59cd035b3a0474e6a207f225798f4165773d83.zip | |
pptp: dst_release sk_dst_cache in pptp_sock_destruct
commit 9417d81f4f8adfe20a12dd1fadf73a618cbd945d upstream.
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
otherwise, the dst refcnt will leak.
It can be reproduced by this syz log:
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
Consecutive dmesg warnings will occur:
unregister_netdevice: waiting for lo to become free. Usage count = 1
v1->v2:
- use rcu_dereference_protected() instead of rcu_dereference_check(),
as suggested by Eric.
Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/net/ppp/pptp.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c index bb1ab1ffbc8b..5dd0fe1635b9 100644 --- a/drivers/net/ppp/pptp.c +++ b/drivers/net/ppp/pptp.c @@ -579,6 +579,7 @@ static void pptp_sock_destruct(struct sock *sk) pppox_unbind_sock(sk); } skb_queue_purge(&sk->sk_receive_queue); + dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); } static int pptp_create(struct net *net, struct socket *sock) |