diff mbox

[net] Phonet: fix potential use-after-free in pep_sock_close()

Message ID 1274796709-29988-1-git-send-email-remi.denis-courmont@nokia.com
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Rémi Denis-Courmont May 25, 2010, 2:11 p.m. UTC 
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

sk_common_release() might destroy our last reference to the socket.
So an extra temporary reference is needed during cleanup.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
---
 net/phonet/pep.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

Comments

David Miller May 25, 2010, 11:08 p.m. UTC | #1 
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Date: Tue, 25 May 2010 17:11:49 +0300

> sk_common_release() might destroy our last reference to the socket.
> So an extra temporary reference is needed during cleanup.
> 
> Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

Patch applied, thank you.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index af4d38b..7b048a3 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -626,6 +626,7 @@  static void pep_sock_close(struct sock *sk, long timeout)
 	struct pep_sock *pn = pep_sk(sk);
 	int ifindex = 0;
 
+	sock_hold(sk); /* keep a reference after sk_common_release() */
 	sk_common_release(sk);
 
 	lock_sock(sk);
@@ -644,6 +645,7 @@  static void pep_sock_close(struct sock *sk, long timeout)
 
 	if (ifindex)
 		gprs_detach(sk);
+	sock_put(sk);
 }
 
 static int pep_wait_connreq(struct sock *sk, int noblock)