From patchwork Wed May 26 10:44:44 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?R=C3=A9mi_Denis-Courmont?= X-Patchwork-Id: 53607 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 92FCBB7D1A for ; Wed, 26 May 2010 20:43:55 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933883Ab0EZKnu (ORCPT ); Wed, 26 May 2010 06:43:50 -0400 Received: from smtp.nokia.com ([192.100.122.233]:26285 "EHLO mgw-mx06.nokia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752265Ab0EZKnu (ORCPT ); Wed, 26 May 2010 06:43:50 -0400 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx06.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o4QAhAcR032638 for ; Wed, 26 May 2010 13:43:47 +0300 Received: from esebh102.NOE.Nokia.com ([172.21.138.183]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 26 May 2010 13:43:10 +0300 Received: from mgw-sa02.ext.nokia.com ([147.243.1.48]) by esebh102.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Wed, 26 May 2010 13:43:09 +0300 Received: from localhost.localdomain (esdhcp037246.research.nokia.com [172.21.37.246]) by mgw-sa02.ext.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id o4QAh8lj009612 for ; Wed, 26 May 2010 13:43:08 +0300 From: =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= To: netdev@vger.kernel.org Subject: [PATCH net 1/1] Phonet: listening socket lock protects the connected socket list Date: Wed, 26 May 2010 13:44:44 +0300 Message-Id: <1274870684-18428-1-git-send-email-remi.denis-courmont@nokia.com> X-Mailer: git-send-email 1.7.0.4 MIME-Version: 1.0 X-OriginalArrivalTime: 26 May 2010 10:43:09.0840 (UTC) FILETIME=[3BAA0900:01CAFCC0] X-Nokia-AV: Clean Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Rémi Denis-Courmont The accept()'d socket need to be unhashed while the (listen()'ing) socket lock is held. This fixes a race condition that could lead to an OOPS. Signed-off-by: Rémi Denis-Courmont --- net/phonet/pep.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 7b048a3..94d72e8 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk) lock_sock(sk); if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) { skparent = pn->listener; - sk_del_node_init(sk); release_sock(sk); - sk = skparent; pn = pep_sk(skparent); - lock_sock(sk); + lock_sock(skparent); + sk_del_node_init(sk); + sk = skparent; } /* Unhash a listening sock only when it is closed * and all of its active connected pipes are closed. */