From: Cong Wang <xiyou.wangcong@xxxxxxxxx> Date: Tue, 5 Jul 2016 22:12:36 -0700 > Matt reported that we have a NULL pointer dereference > in ppp_pernet() from ppp_connect_channel(), > i.e. pch->chan_net is NULL. > > This is due to that a parallel ppp_unregister_channel() > could happen while we are in ppp_connect_channel(), during > which pch->chan_net set to NULL. Since we need a reference > to net per channel, it makes sense to sync the refcnt > with the life time of the channel, therefore we should > release this reference when we destroy it. > > Fixes: 1f461dcdd296 ("ppp: take reference on channels netns") > Reported-by: Matt Bennett <Matt.Bennett@xxxxxxxxxxxxxxxxxxx> > Cc: Paul Mackerras <paulus@xxxxxxxxx> > Cc: linux-ppp@xxxxxxxxxxxxxxx > Cc: Guillaume Nault <g.nault@xxxxxxxxxxxx> > Cc: Cyrill Gorcunov <gorcunov@xxxxxxxxxx> > Signed-off-by: Cong Wang <xiyou.wangcong@xxxxxxxxx> Applied and queued up for -stable. -- To unsubscribe from this list: send the line "unsubscribe linux-ppp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html