pppoe.c: Fix kernel panic caused by __pppoe_xmit

__pppoe_xmit function return value was invalid resulting in
additional call to kfree_skb on already freed skb. This resulted in
memory corruption and consequent kernel panic after PPPoE peer
terminated the link.

This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b.

Reported-by: Gorik Van Steenberge <[email protected]>
Reported-by: Daniel Kenzelmann <[email protected]>
Reported-by: Denys Fedoryshchenko <[email protected]>
Reported-by: Pawel Staszewski <[email protected]>
Diagnosed-by: Andrej Ota <[email protected]>
Diagnosed-by: Eric Dumazet <[email protected]>
Tested-by: Denys Fedoryshchenko <[email protected]>
Tested-by: Pawel Staszewski <[email protected]>
Signed-off-by: Jarek Poplawski <[email protected]>
Signed-off-by: Andrej Ota <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index d72fb0519a2aa674a8757f5146b0df19655d9749..78c0e3c9b2b5fcb8d42fb910ab2416e4db787dc7 100644 (file)
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 
 abort:
        kfree_skb(skb);
-       return 0;
+       return 1;
 }
 
 /************************************************************************