pptp: dst_release sk_dst_cache in pptp_sock_destruct

lxin · davem330 · commit 9417d81f4f8a · 2019-03-13T14:22:49.000-07:00
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect, so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct, otherwise, the dst refcnt will leak. It can be reproduced by this syz log: r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @Local}}, 0x1e) connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @Remote}}, 0x1e) Consecutive dmesg warnings will occur: unregister_netdevice: waiting for lo to become free. Usage count = 1 v1->v2: - use rcu_dereference_protected() instead of rcu_dereference_check(), as suggested by Eric. Fixes: 00959ad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
@@ -532,6 +532,7 @@ static void pptp_sock_destruct(struct sock *sk)
 		pppox_unbind_sock(sk);
 	}
 	skb_queue_purge(&sk->sk_receive_queue);
+	dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
 }
 
 static int pptp_create(struct net *net, struct socket *sock, int kern)

Original file line number	Diff line number	Diff line change
`@@ -532,6 +532,7 @@ static void pptp_sock_destruct(struct sock *sk)`
`532`	`532`	`pppox_unbind_sock(sk);`
`533`	`533`	`}`
`534`	`534`	`skb_queue_purge(&sk->sk_receive_queue);`
	`535`	`+ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));`
`535`	`536`	`}`
`536`	`537`
`537`	`538`	`static int pptp_create(struct net net, struct socket sock, int kern)`