Xin Long 12dd6b12cb l2tp: remove skb_dst_set() from l2tp_xmit_skb() ... [ Upstream commit 27d5332366 ] In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set skb's dst. However, it will eventually call inet6_csk_xmit() or ip_queue_xmit() where skb's dst will be overwritten by: skb_dst_set_noref(skb, dst); without releasing the old dst in skb. Then it causes dst/dev refcnt leak: unregister_netdevice: waiting for eth0 to become free. Usage count = 1 This can be reproduced by simply running: # modprobe l2tp_eth && modprobe l2tp_ip # sh ./tools/testing/selftests/net/l2tp.sh So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst should be dropped. This patch is to fix it by removing skb_dst_set() from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core(). Fixes: 3557baabf2 ("[L2TP]: PPP over L2TP driver core") Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: James Chapman <jchapman@katalix.com> Tested-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-22 09:22:19 +02:00
..
Kconfig	l2tp: Call udp_sock_create	2014-07-14 16:12:15 -07:00
l2tp_core.c	l2tp: remove skb_dst_set() from l2tp_xmit_skb()	2020-07-22 09:22:19 +02:00
l2tp_core.h	l2tp: don't register sessions in l2tp_session_create()	2020-05-27 16:43:06 +02:00
l2tp_debugfs.c	l2tp: remove configurable payload offset	2018-11-04 14:52:43 +01:00
l2tp_eth.c	l2tp: initialise l2tp_eth sessions before registering them	2020-05-27 16:43:06 +02:00
l2tp_ip.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-11 09:22:59 +02:00
l2tp_ip6.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-11 09:22:59 +02:00
l2tp_netlink.c	l2tp: remove configurable payload offset	2018-11-04 14:52:43 +01:00
l2tp_ppp.c	l2tp: initialise PPP sessions before registering them	2020-05-27 16:43:07 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00