diff mbox

[net,1/1] Phonet: listening socket lock protects the connected socket list

Message ID 1274870684-18428-1-git-send-email-remi.denis-courmont@nokia.com
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Rémi Denis-Courmont May 26, 2010, 10:44 a.m. UTC 
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

The accept()'d socket need to be unhashed while the (listen()'ing)
socket lock is held. This fixes a race condition that could lead to an
OOPS.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
---
 net/phonet/pep.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

Comments

David Miller May 29, 2010, 7:20 a.m. UTC | #1 
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Date: Wed, 26 May 2010 13:44:44 +0300

> From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
> 
> The accept()'d socket need to be unhashed while the (listen()'ing)
> socket lock is held. This fixes a race condition that could lead to an
> OOPS.
> 
> Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7b048a3..94d72e8 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1045,12 +1045,12 @@  static void pep_sock_unhash(struct sock *sk)
 	lock_sock(sk);
 	if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
 		skparent = pn->listener;
-		sk_del_node_init(sk);
 		release_sock(sk);
 
-		sk = skparent;
 		pn = pep_sk(skparent);
-		lock_sock(sk);
+		lock_sock(skparent);
+		sk_del_node_init(sk);
+		sk = skparent;
 	}
 	/* Unhash a listening sock only when it is closed
 	 * and all of its active connected pipes are closed. */