target/linux/generic/patches-3.18/081-05-ppp-fix-pppoe_dev-deletion-condition-in-pppoe_releas.patch

   1 From: Guillaume Nault <g.nault@alphalink.fr>
   2 Date: Thu, 22 Oct 2015 16:57:10 +0200
   3 Subject: [PATCH] ppp: fix pppoe_dev deletion condition in pppoe_release()
   4
   5 We can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.
   6 PPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is
   7 NULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies
   8 (po->pppoe_dev != NULL).
   9 Since we're releasing a PPPoE socket, we want to release the pppoe_dev
  10 if it exists and reset sk_state to PPPOX_DEAD, no matter the previous
  11 value of sk_state. So we can just check for po->pppoe_dev and avoid any
  12 assumption on sk->sk_state.
  13
  14 Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
  15 Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
  16 Signed-off-by: David S. Miller <davem@davemloft.net>
  17 ---
  18
  19 --- a/drivers/net/ppp/pppoe.c
  20 +++ b/drivers/net/ppp/pppoe.c
  21 @@ -589,7 +589,7 @@ static int pppoe_release(struct socket *
  22
  23         po = pppox_sk(sk);
  24
  25 -       if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
  26 +       if (po->pppoe_dev) {
  27                 dev_put(po->pppoe_dev);
  28                 po->pppoe_dev = NULL;
  29         }