[PATCH net] pptp: drop packets received before connect

[PATCH net] pptp: drop packets received before connect

[Qingfang Deng]

pptp_bind() publishes the socket by its local call ID before it is
connected, so GRE packets can reach pptp_rcv_core() while
PPPOX_CONNECTED is clear.

Such packets are queued on sk_receive_queue, but PPTP provides no recvmsg
operation and never drains the queue after connect. The packets therefore
remain there until socket destruction.

Drop such packets immediately instead. Since PPTP no longer queues packets
on sk_receive_queue, remove the corresponding destructor purge.

Assisted-by: Codex:GPT-5.6
Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 drivers/net/ppp/pptp.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index cc8c102122d8..a797a0606f6b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -278,11 +278,8 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
 	__u8 *payload;
 	struct pptp_gre_header *header;
 
-	if (!(sk->sk_state & PPPOX_CONNECTED)) {
-		if (sock_queue_rcv_skb(sk, skb))
-			goto drop;
-		return NET_RX_SUCCESS;
-	}
+	if (!(sk->sk_state & PPPOX_CONNECTED))
+		goto drop;
 
 	header = (struct pptp_gre_header *)(skb->data);
 	headersize  = sizeof(*header);
@@ -539,7 +536,6 @@ static void pptp_sock_destruct(struct sock *sk)
 		del_chan(pppox_sk(sk));
 		pppox_unbind_sock(sk);
 	}
-	skb_queue_purge(&sk->sk_receive_queue);
 	dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
 }
 
-- 
2.43.0

Re: [PATCH net] pptp: drop packets received before connect

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 11 Aug 2026 15:49:47 +0800 you wrote:
> pptp_bind() publishes the socket by its local call ID before it is
> connected, so GRE packets can reach pptp_rcv_core() while
> PPPOX_CONNECTED is clear.
> 
> Such packets are queued on sk_receive_queue, but PPTP provides no recvmsg
> operation and never drains the queue after connect. The packets therefore
> remain there until socket destruction.
> 
> [...]

Here is the summary with links:
  - [net] pptp: drop packets received before connect
    https://git.kernel.org/netdev/net-next/c/a0d6255b4adc

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html