* [PATCHv2 net] pptp: dst_release sk_dst_cache in pptp_sock_destruct
@ 2019-03-13 9:00 Xin Long
2019-03-13 21:24 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Xin Long @ 2019-03-13 9:00 UTC (permalink / raw)
To: network dev; +Cc: davem, Eric Dumazet, Dmitry Kozlov
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
otherwise, the dst refcnt will leak.
It can be reproduced by this syz log:
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
Consecutive dmesg warnings will occur:
unregister_netdevice: waiting for lo to become free. Usage count = 1
v1->v2:
- use rcu_dereference_protected() instead of rcu_dereference_check(),
as suggested by Eric.
Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
drivers/net/ppp/pptp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 8f09edd..50c6055 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -532,6 +532,7 @@ static void pptp_sock_destruct(struct sock *sk)
pppox_unbind_sock(sk);
}
skb_queue_purge(&sk->sk_receive_queue);
+ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
}
static int pptp_create(struct net *net, struct socket *sock, int kern)
--
2.1.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCHv2 net] pptp: dst_release sk_dst_cache in pptp_sock_destruct
2019-03-13 9:00 [PATCHv2 net] pptp: dst_release sk_dst_cache in pptp_sock_destruct Xin Long
@ 2019-03-13 21:24 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-03-13 21:24 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, edumazet, xeb
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 13 Mar 2019 17:00:48 +0800
> sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
> so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
> otherwise, the dst refcnt will leak.
>
> It can be reproduced by this syz log:
>
> r1 = socket$pptp(0x18, 0x1, 0x2)
> bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
> connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
>
> Consecutive dmesg warnings will occur:
>
> unregister_netdevice: waiting for lo to become free. Usage count = 1
>
> v1->v2:
> - use rcu_dereference_protected() instead of rcu_dereference_check(),
> as suggested by Eric.
>
> Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
> Reported-by: Xiumei Mu <xmu@redhat.com>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Applied and queued up for -stable, thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-13 21:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-13 9:00 [PATCHv2 net] pptp: dst_release sk_dst_cache in pptp_sock_destruct Xin Long
2019-03-13 21:24 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.