[PATCH net] ppp: fix pppoe_dev deletion condition in pppoe_release()

[PATCH net] ppp: fix pppoe_dev deletion condition in pppoe_release()

[Guillaume Nault]

We can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.
PPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is
NULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies
(po->pppoe_dev != NULL).
Since we're releasing a PPPoE socket, we want to release the pppoe_dev
if it exists and reset sk_state to PPPOX_DEAD, no matter the previous
value of sk_state. So we can just check for po->pppoe_dev and avoid any
assumption on sk->sk_state.

Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
---
 drivers/net/ppp/pppoe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 2ed7506..5e0b432 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -589,7 +589,7 @@ static int pppoe_release(struct socket *sock)
 
 	po = pppox_sk(sk);
 
-	if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+	if (po->pppoe_dev) {
 		dev_put(po->pppoe_dev);
 		po->pppoe_dev = NULL;
 	}
-- 
2.6.1

Re: [PATCH net] ppp: fix pppoe_dev deletion condition in pppoe_release()

[David Miller]

From: Guillaume Nault <g.nault@alphalink.fr>
Date: Thu, 22 Oct 2015 16:57:10 +0200

> We can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.
> PPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is
> NULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies
> (po->pppoe_dev != NULL).
> Since we're releasing a PPPoE socket, we want to release the pppoe_dev
> if it exists and reset sk_state to PPPOX_DEAD, no matter the previous
> value of sk_state. So we can just check for po->pppoe_dev and avoid any
> assumption on sk->sk_state.
> 
> Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>

Applied and queued up for -stable, thanks.

Re: [PATCH net] ppp: fix pppoe_dev deletion condition in pppoe_release()

[Christoph Schulz]

Hello!

David Miller schrieb am Fri, 23 Oct 2015 03:30:48 -0700 (PDT):

> From: Guillaume Nault <g.nault@alphalink.fr>
> Date: Thu, 22 Oct 2015 16:57:10 +0200
>
>> We can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.
>> PPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is
>> NULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies
>> (po->pppoe_dev != NULL).
>> Since we're releasing a PPPoE socket, we want to release the pppoe_dev
>> if it exists and reset sk_state to PPPOX_DEAD, no matter the previous
>> value of sk_state. So we can just check for po->pppoe_dev and avoid any
>> assumption on sk->sk_state.
>>
>> Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
>> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
>
> Applied and queued up for -stable, thanks.

Somehow this commit (1acea4f6ce1b1c0941438aca75dd2e5c6b09db60) did not  
make it into Linux 4.2.6, 4.1.13, or 3.18.24. But I don't find it in  
your stable bundle on Patchwork either. Has this patch been  
inadvertently "lost in translation"?


Best regards,
-- 
Christoph Schulz