pptp: fix pptp_xmit() error path

JIRA: https://issues.redhat.com/browse/RHEL-115633
Upstream Status: linux.git

commit ae63338
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Aug 7 14:21:46 2025 +0000

    pptp: fix pptp_xmit() error path

    I accidentally added a bug in pptp_xmit() that syzbot caught for us.

    Only call ip_rt_put() if a route has been allocated.

    BUG: unable to handle page fault for address: ffffffffffffffdb
    PGD df3b067 P4D df3b067 PUD df3d067 PMD 0
    Oops: Oops: 0002 [#1] SMP KASAN PTI
    CPU: 1 UID: 0 PID: 6346 Comm: syz.0.336 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full)
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
    RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline]
    RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline]
    RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline]
    RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline]
    RIP: 0010:rcuref_put+0x172/0x210 include/linux/rcuref.h:173
    Call Trace:
     <TASK>
     dst_release+0x24/0x1b0 net/core/dst.c:167
     ip_rt_put include/net/route.h:285 [inline]
     pptp_xmit+0x14b/0x1a90 drivers/net/ppp/pptp.c:267
     __ppp_channel_push+0xf2/0x1c0 drivers/net/ppp/ppp_generic.c:2166
     ppp_channel_push+0x123/0x660 drivers/net/ppp/ppp_generic.c:2198
     ppp_write+0x2b0/0x400 drivers/net/ppp/ppp_generic.c:544
     vfs_write+0x27b/0xb30 fs/read_write.c:684
     ksys_write+0x145/0x250 fs/read_write.c:738
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Fixes: de9c486 ("pptp: ensure minimal skb length in pptp_xmit()")
    Reported-by: syzbot+27d7cfbc93457e472e00@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/689095a5.050a0220.1fc43d.0009.GAE@google.com/
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20250807142146.2877060-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Guillaume Nault <gnault@redhat.com>

Author: Guillaume Nault

drivers/net/ppp/pptp.c

@@ -159,17 +159,17 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 	int len;
 	unsigned char *data;
 	__u32 seq_recv;
-	struct rtable *rt = NULL;
+	struct rtable *rt;
 	struct net_device *tdev;
 	struct iphdr  *iph;
 	int    max_headroom;
 
 	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
-		goto tx_error;
+		goto tx_drop;
 
 	rt = pptp_route_output(po, &fl4);
 	if (IS_ERR(rt))
-		goto tx_error;
+		goto tx_drop;
 
 	tdev = rt->dst.dev;
 
@@ -265,6 +265,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 
 tx_error:
 	ip_rt_put(rt);
+tx_drop:
 	kfree_skb(skb);
 	return 1;
 }