queue-4.20/pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch

   1 From foo@baz Thu Mar 14 23:20:15 PDT 2019
   2 From: Xin Long <lucien.xin@gmail.com>
   3 Date: Wed, 13 Mar 2019 17:00:48 +0800
   4 Subject: pptp: dst_release sk_dst_cache in pptp_sock_destruct
   5
   6 From: Xin Long <lucien.xin@gmail.com>
   7
   8 [ Upstream commit 9417d81f4f8adfe20a12dd1fadf73a618cbd945d ]
   9
  10 sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
  11 so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
  12 otherwise, the dst refcnt will leak.
  13
  14 It can be reproduced by this syz log:
  15
  16   r1 = socket$pptp(0x18, 0x1, 0x2)
  17   bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
  18   connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
  19
  20 Consecutive dmesg warnings will occur:
  21
  22   unregister_netdevice: waiting for lo to become free. Usage count = 1
  23
  24 v1->v2:
  25   - use rcu_dereference_protected() instead of rcu_dereference_check(),
  26     as suggested by Eric.
  27
  28 Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
  29 Reported-by: Xiumei Mu <xmu@redhat.com>
  30 Signed-off-by: Xin Long <lucien.xin@gmail.com>
  31 Signed-off-by: David S. Miller <davem@davemloft.net>
  32 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  33 ---
  34  drivers/net/ppp/pptp.c |    1 +
  35  1 file changed, 1 insertion(+)
  36
  37 --- a/drivers/net/ppp/pptp.c
  38 +++ b/drivers/net/ppp/pptp.c
  39 @@ -537,6 +537,7 @@ static void pptp_sock_destruct(struct so
  40                 pppox_unbind_sock(sk);
  41         }
  42         skb_queue_purge(&sk->sk_receive_queue);
  43 +       dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
  44  }
  45
  46  static int pptp_create(struct net *net, struct socket *sock, int kern)