kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Eric Dumazet abf2f0c294 pptp: fix pptp_xmit() error path 
[ Upstream commit ae633388ca ]

I accidentally added a bug in pptp_xmit() that syzbot caught for us.

Only call ip_rt_put() if a route has been allocated.

BUG: unable to handle page fault for address: ffffffffffffffdb
PGD df3b067 P4D df3b067 PUD df3d067 PMD 0
Oops: Oops: 0002 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 6346 Comm: syz.0.336 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline]
RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline]
RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline]
RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline]
RIP: 0010:rcuref_put+0x172/0x210 include/linux/rcuref.h:173
Call Trace:
 <TASK>
 dst_release+0x24/0x1b0 net/core/dst.c:167
 ip_rt_put include/net/route.h:285 [inline]
 pptp_xmit+0x14b/0x1a90 drivers/net/ppp/pptp.c:267
 __ppp_channel_push+0xf2/0x1c0 drivers/net/ppp/ppp_generic.c:2166
 ppp_channel_push+0x123/0x660 drivers/net/ppp/ppp_generic.c:2198
 ppp_write+0x2b0/0x400 drivers/net/ppp/ppp_generic.c:544
 vfs_write+0x27b/0xb30 fs/read_write.c:684
 ksys_write+0x145/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: de9c4861fb ("pptp: ensure minimal skb length in pptp_xmit()")
Reported-by: syzbot+27d7cfbc93457e472e00@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/689095a5.050a0220.1fc43d.0009.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250807142146.2877060-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-08-15 12:05:11 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi Revert "ACPI: battery: negate current when discharging" 2025-07-17 18:32:08 +02:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: pata_cs5536: fix build on 32-bit UML 2025-07-10 15:59:50 +02:00
atm atm: idt77252: Add missing dma_map_error() 2025-07-17 18:32:13 +02:00
auxdisplay auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" 2025-06-04 14:40:07 +02:00
base regmap: fix potential memory leak of regmap_bus 2025-08-15 12:04:46 +02:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block ublk: use vmalloc for ublk_device's __queues 2025-08-15 12:04:52 +02:00
bluetooth Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID 2025-07-24 08:51:52 +02:00
bus bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() 2025-08-15 12:04:48 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char hwrng: mtk - handle devm_pm_runtime_enable errors 2025-08-15 12:05:03 +02:00
clk clk: sunxi-ng: v3s: Fix de clock definition 2025-08-15 12:05:03 +02:00
clocksource clocksource: mips-gic-timer: Enable counter when CPUs start 2025-06-04 14:40:12 +02:00
comedi comedi: comedi_test: Fix possible deletion of uninitialized timers 2025-08-15 12:04:50 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: interrupt-cnt: Protect enable/disable OPs with mutex 2025-06-27 11:07:16 +01:00
cpufreq cpufreq: Init policy->rwsem before it may be possibly used 2025-08-15 12:04:55 +02:00
cpuidle cpuidle: menu: Avoid discarding useful information 2025-06-04 14:40:11 +02:00
crypto crypto: qat - fix seq_file position update in adf_ring_next() 2025-08-15 12:05:04 +02:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:52:53 +01:00
dax dax: delete a stale directory pmem 2024-12-14 19:53:41 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Check governor before using governor->name 2025-08-15 12:04:55 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: nbpfaxi: Add missing check after DMA map 2025-08-15 12:05:04 +02:00
dma-buf dma-buf: fix timeout handling in dma_resv_wait_timeout v2 2025-07-10 15:59:53 +02:00
edac EDAC/altera: Use correct write width with the INTTEST register 2025-06-27 11:07:29 +01:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware firmware: arm_scmi: Ensure that the message-id supports fastchannel 2025-07-06 10:58:04 +02:00
fpga fpga: altera-cvp: Increase credit timeout 2025-06-04 14:40:10 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: pca953x: fix IRQ storm on system wake up 2025-06-04 14:40:01 +02:00
gpu drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value 2025-08-15 12:04:57 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: mcp2221: Set driver data before I2C adapter add 2025-07-24 08:51:54 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-04-25 10:43:47 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-06 10:57:58 +02:00
hwmon hwmon: (corsair-cpro) Validate the size of the received input buffer 2025-07-24 08:51:52 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: Only check bottom two claim bits 2025-07-06 10:57:55 +02:00
i2c i2c: virtio: Avoid hang by using interruptible completion wait 2025-08-15 12:04:48 +02:00
i3c i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() 2025-06-04 14:40:22 +02:00
idle cpuidle, intel_idle: Fix CPUIDLE_FLAG_IBRS 2025-03-13 12:53:11 +01:00
iio iio: adc: ad7949: use spi_is_bpw_supported() 2025-08-15 12:04:46 +02:00
infiniband RDMA/hns: Fix -Wframe-larger-than issue 2025-08-15 12:05:02 +02:00
input Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT 2025-08-15 12:04:45 +02:00
interconnect interconnect: qcom: sc8180x: specify num_nodes 2025-08-15 12:04:55 +02:00
iommu iommu/amd: Ensure GA log notifier callbacks finish running before module unload 2025-06-27 11:07:34 +01:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip: Build IMX_MU_MSI only on ARM 2025-08-15 12:05:10 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-03 08:49:50 +02:00
leds leds: multicolor: Fix intensity setting while SW blinking 2025-07-06 10:57:54 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: Not protect module_put with spin_lock_irqsave 2025-07-06 10:57:54 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:46:57 +02:00
md raid10: cleanup memleak at raid10_make_request 2025-07-17 18:32:11 +02:00
media media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check 2025-08-15 12:05:01 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:33:39 +02:00
memstick memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() 2025-07-24 08:51:49 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:53:40 +01:00
mfd mfd: max14577: Fix wakeup source leaks on device unbind 2025-07-06 10:57:54 +02:00
misc Revert "vmci: Prevent the dispatching of uninitialized payloads" 2025-08-15 12:04:54 +02:00
mmc mmc: sdhci_am654: Workaround for Errata i2312 2025-07-24 08:51:49 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: rawnand: atmel: set pmecc data setup time 2025-08-15 12:05:05 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net pptp: fix pptp_xmit() error path 2025-08-15 12:05:11 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:25:02 +02:00
ntb ntb_hw_amd: Add NTB PCI ID for new gen CPU 2025-05-02 07:47:04 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm libnvdimm/labels: Fix divide error in nd_label_data_init() 2025-06-04 14:40:04 +02:00
nvme nvme: fix misaccounting of nvme-mpath inflight I/O 2025-07-24 08:51:52 +02:00
nvmem nvmem: layouts: u-boot-env: remove crc32 endianness conversion 2025-07-24 08:51:55 +02:00
of of: module: add buffer overflow check in of_modalias() 2025-05-02 07:47:08 +02:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-21 13:49:02 +01:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport_pc: add support for ASIX AX99100 2025-02-21 13:50:11 +01:00
pci PCI: pnv_php: Fix surprise plug detection and recovery 2025-08-15 12:05:08 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:10:20 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Initialise cmn->cpu earlier 2025-06-04 14:40:25 +02:00
phy phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode 2025-07-24 08:51:47 +02:00
pinctrl pinctrl: sunxi: Fix memory leak on krealloc failure 2025-08-15 12:05:02 +02:00
platform platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots 2025-08-15 12:04:48 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set 2025-08-15 12:05:01 +02:00
powercap powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() 2025-08-15 12:04:54 +02:00
pps pps: fix poll support 2025-08-15 12:04:54 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: allow reading of currently dialed frequency to succeed on free-running clocks 2025-06-27 11:07:39 +01:00
pwm pwm: mediatek: Ensure to disable clocks in error path 2025-07-17 18:32:09 +02:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:07:36 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: core: fix NULL dereference on unbind due to stale coupling data 2025-08-15 12:04:45 +02:00
remoteproc remoteproc: core: Release rproc->clean_table after rproc_attach() fails 2025-06-27 11:07:31 +01:00
reset reset: k210: fix OF node leak in probe() error path 2024-10-17 15:20:47 +02:00
rpmsg rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() 2025-06-27 11:07:15 +01:00
rtc rtc: rv3028: fix incorrect maximum clock rate handling 2025-08-15 12:05:06 +02:00
s390 s390/pkey: Prevent overflow in size calculation for memdup_user() 2025-07-06 10:57:59 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: sd: Make sd shutdown issue START STOP UNIT appropriately 2025-08-15 12:05:08 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2024-12-27 13:52:58 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:53:22 +01:00
soc soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS 2025-08-15 12:04:54 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-15 12:05:04 +02:00
spi spi: spi-fsl-dspi: Clear completion counter before initiating transfer 2025-07-10 15:59:47 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging staging: nvec: Fix incorrect null termination of battery manufacturer 2025-08-15 12:04:56 +02:00
target scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() 2025-07-10 15:59:50 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: Prevent size calculation wraparound on 32-bit kernels 2025-06-27 11:07:36 +01:00
thermal thermal/drivers/qoriq: Power down TMU on system suspend 2025-06-04 14:40:03 +02:00
thunderbolt thunderbolt: Fix bit masking in tb_dp_port_set_hops() 2025-07-24 08:51:47 +02:00
tty pch_uart: Fix dma_sync_sg_for_device() nents value 2025-07-24 08:51:47 +02:00
ufs scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume 2025-08-15 12:05:07 +02:00
uio uio_hv_generic: Align ring size to system page 2025-07-06 10:57:58 +02:00
usb usb: early: xhci-dbc: Fix early_ioremap leak 2025-08-15 12:04:54 +02:00
vdpa vdpa/mlx5: Fix oversized null mkey longer than 32bit 2025-04-25 10:43:40 +02:00
vfio vfio/pci: Separate SR-IOV VF dev_set 2025-08-15 12:05:07 +02:00
vhost vhost-scsi: Fix log flooding with target does not exist errors 2025-08-15 12:05:05 +02:00
video fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref 2025-08-15 12:05:04 +02:00
virt drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl 2025-03-13 12:53:23 +01:00
virtio virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN 2025-06-04 14:40:01 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: ziirave_wdt: check record length in ziirave_firm_verify() 2025-08-15 12:05:03 +02:00
xen xen/gntdev: remove struct gntdev_copy_batch from stack 2025-08-15 12:04:58 +02:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00