archive mirror
 help / color / mirror / Atom feed
* [PATCH for-3.18 14/24] ppp: defer netns reference release for ppp channel
       [not found] <>
@ 2017-05-09 14:54 ` Amit Pundir
  0 siblings, 0 replies; only message in thread
From: Amit Pundir @ 2017-05-09 14:54 UTC (permalink / raw)
  To: Greg KH
  Cc: stable, WANG Cong, Paul Mackerras, linux-ppp, Guillaume Nault,
	Cyrill Gorcunov, David S . Miller

From: WANG Cong <>

commit 205e1e255c479f3fd77446415706463b282f94e4 upstream.

Matt reported that we have a NULL pointer dereference
in ppp_pernet() from ppp_connect_channel(),
i.e. pch->chan_net is NULL.

This is due to that a parallel ppp_unregister_channel()
could happen while we are in ppp_connect_channel(), during
which pch->chan_net set to NULL. Since we need a reference
to net per channel, it makes sense to sync the refcnt
with the life time of the channel, therefore we should
release this reference when we destroy it.

Fixes: 1f461dcdd296 ("ppp: take reference on channels netns")
Reported-by: Matt Bennett <>
Cc: Paul Mackerras <>
Cc: Guillaume Nault <>
Cc: Cyrill Gorcunov <>
Signed-off-by: Cong Wang <>
Reviewed-by: Cyrill Gorcunov <>
Signed-off-by: David S. Miller <>
Signed-off-by: Amit Pundir <>
 drivers/net/ppp/ppp_generic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index e3fbbbbd84e7..3dd1c19756ec 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2342,8 +2342,6 @@ ppp_unregister_channel(struct ppp_channel *chan)
-	put_net(pch->chan_net);
-	pch->chan_net = NULL;
 	pch->file.dead = 1;
@@ -2960,6 +2958,9 @@ ppp_disconnect_channel(struct channel *pch)
 static void ppp_destroy_channel(struct channel *pch)
+	put_net(pch->chan_net);
+	pch->chan_net = NULL;
 	if (!pch->file.dead) {

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2017-05-09 14:54 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <>
2017-05-09 14:54 ` [PATCH for-3.18 14/24] ppp: defer netns reference release for ppp channel Amit Pundir

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).