Eric Dumazet ae633388ca pptp: fix pptp_xmit() error path ... I accidentally added a bug in pptp_xmit() that syzbot caught for us. Only call ip_rt_put() if a route has been allocated. BUG: unable to handle page fault for address: ffffffffffffffdb PGD df3b067 P4D df3b067 PUD df3d067 PMD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6346 Comm: syz.0.336 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline] RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline] RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline] RIP: 0010:rcuref_put+0x172/0x210 include/linux/rcuref.h:173 Call Trace: <TASK> dst_release+0x24/0x1b0 net/core/dst.c:167 ip_rt_put include/net/route.h:285 [inline] pptp_xmit+0x14b/0x1a90 drivers/net/ppp/pptp.c:267 __ppp_channel_push+0xf2/0x1c0 drivers/net/ppp/ppp_generic.c:2166 ppp_channel_push+0x123/0x660 drivers/net/ppp/ppp_generic.c:2198 ppp_write+0x2b0/0x400 drivers/net/ppp/ppp_generic.c:544 vfs_write+0x27b/0xb30 fs/read_write.c:684 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: de9c4861fb ("pptp: ensure minimal skb length in pptp_xmit()") Reported-by: syzbot+27d7cfbc93457e472e00@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/689095a5.050a0220.1fc43d.0009.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250807142146.2877060-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-08-07 07:47:04 -07:00
..
bsd_comp.c
Kconfig
Makefile
ppp_async.c	ppp: fix ppp_async_encode() illegal access	2024-10-10 08:47:13 -07:00
ppp_deflate.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
ppp_generic.c	ppp: Replace per-CPU recursion counter with lock-owner field	2025-07-17 15:36:18 +02:00
ppp_mppe.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
ppp_mppe.h
ppp_synctty.c	net: ppp: Add bound checking for skb data on ppp_sync_txmung	2025-04-10 11:24:17 +02:00
pppoe.c	pppoe: drop PACKET_OTHERHOST before skb_share_check()	2025-06-24 16:37:02 -07:00
pppox.c
pptp.c	pptp: fix pptp_xmit() error path	2025-08-07 07:47:04 -07:00