kernel panic in pppoe_release

["Murat Sezgin" <msezgin@codeaurora.org>]

Hi all,

We are using 3.4.103 kernel on our openwrt router platform. In the event of
interface down, we get kernel panic in the pppoe_release() function, because
the po->pppoe_dev comes to this function as NULL and dev_put() is called
without doing any NULL check.

I see that openwrt community has done an improvement for this issue with the
following commits in 3.18 and 4.0 kernels.

https://dev.openwrt.org/changeset/45653

I back ported these commits to our kernel and they increased the issue
occurrence frequency, but they didn't fix the issue completely. I ended up
that we need a NULL check in the pppoe_release() function as well. It seems
there is still a race between the pppoe_release() and the pppoe_flush_dev().
So, added the below change, but I would like to see whether this may have
side effects or not.

Can somebody please make comments on this?


@@ -589,7 +606,7 @@ static int pppoe_release(struct socket *sock)
 
        po = pppox_sk(sk);
 
-       if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+       if (po->pppoe_dev && sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND |
PPPOX_ZOMBIE)) {
                dev_put(po->pppoe_dev);
                po->pppoe_dev = NULL;
        }

Regards,
Murat