Xin Long 9417d81f4f pptp: dst_release sk_dst_cache in pptp_sock_destruct ... sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect, so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct, otherwise, the dst refcnt will leak. It can be reproduced by this syz log: r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e) Consecutive dmesg warnings will occur: unregister_netdevice: waiting for lo to become free. Usage count = 1 v1->v2: - use rcu_dereference_protected() instead of rcu_dereference_check(), as suggested by Eric. Fixes: 00959ade36 ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-03-13 14:22:49 -07:00
..
bsd_comp.c
Kconfig
Makefile
ppp_async.c
ppp_deflate.c
ppp_generic.c
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c
pppoe.c	net: Fix usage of pskb_trim_rcsum	2019-01-18 14:05:14 -08:00
pppox.c
pptp.c	pptp: dst_release sk_dst_cache in pptp_sock_destruct	2019-03-13 14:22:49 -07:00