From: Xin Long <[email protected]>
Date: Wed, 13 Mar 2019 17:00:48 +0800
> sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
> so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
> otherwise, the dst refcnt will leak.
>
> It can be reproduced by this syz log:
>
> r1 = socket$pptp(0x18, 0x1, 0x2)
> bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
> connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
>
> Consecutive dmesg warnings will occur:
>
> unregister_netdevice: waiting for lo to become free. Usage count = 1
>
> v1->v2:
> - use rcu_dereference_protected() instead of rcu_dereference_check(),
> as suggested by Eric.
>
> Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling
> Protocol)")
> Reported-by: Xiumei Mu <[email protected]>
> Signed-off-by: Xin Long <[email protected]>
Applied and queued up for -stable, thank you.
