Xin Long 73e42f4d2d l2tp: remove skb_dst_set() from l2tp_xmit_skb() ... [ Upstream commit 27d5332366 ] In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set skb's dst. However, it will eventually call inet6_csk_xmit() or ip_queue_xmit() where skb's dst will be overwritten by: skb_dst_set_noref(skb, dst); without releasing the old dst in skb. Then it causes dst/dev refcnt leak: unregister_netdevice: waiting for eth0 to become free. Usage count = 1 This can be reproduced by simply running: # modprobe l2tp_eth && modprobe l2tp_ip # sh ./tools/testing/selftests/net/l2tp.sh So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst should be dropped. This patch is to fix it by removing skb_dst_set() from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core(). Fixes: 3557baabf2 ("[L2TP]: PPP over L2TP driver core") Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: James Chapman <jchapman@katalix.com> Tested-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-22 09:32:47 +02:00
..
Kconfig
l2tp_core.c	l2tp: remove skb_dst_set() from l2tp_xmit_skb()	2020-07-22 09:32:47 +02:00
l2tp_core.h
l2tp_debugfs.c
l2tp_eth.c
l2tp_ip6.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-10 20:24:54 +02:00
l2tp_ip.c	l2tp: do not use inet_hash()/inet_unhash()	2020-06-10 20:24:54 +02:00
l2tp_netlink.c
l2tp_ppp.c
Makefile