From patchwork Mon Nov 2 15:50:07 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 539018 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 37F7E140DA5 for ; Tue, 3 Nov 2015 02:50:16 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=Ss53rIzK; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754097AbbKBPuM (ORCPT ); Mon, 2 Nov 2015 10:50:12 -0500 Received: from mail-pa0-f45.google.com ([209.85.220.45]:34561 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754024AbbKBPuJ (ORCPT ); Mon, 2 Nov 2015 10:50:09 -0500 Received: by padec8 with SMTP id ec8so43061709pad.1 for ; Mon, 02 Nov 2015 07:50:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:subject:from:to:cc:date:content-type:mime-version :content-transfer-encoding; bh=PJgIOkVqicPaYDpFUbnpzhs+DDxmIGawRv6+s/Im7uY=; b=Ss53rIzKpFDc4KAy1b298uGDjcU3mg4ZiN+mFgshv4c+qWt3/5Hj7r//V02swKiPWl xsVLpVUDqmOdU1qypV7RKXT9MSsxv/YZx4Srn3lY2We/CCwavEYGw2hGWa0Q/9HBtgii k6mXZmbANc2L4lXACGR8Rd61jjlmbxwndU5YvTAvm8O/XEeuBrxnbpEFC/nMyrGdtfbC kpoKtXnj0QkIQUYSTtvH9Bu+tyyDENz11oYSoIkqBqX2KaCv1anF+aWsaQo4yJw9zyHH 47gGSZpc/2Wuh8UWvZCgOnnPq99FHjJ8HlP3aUMlwPtl+7RWwh9r4Y6OyrI+OEykkct6 lWiw== X-Received: by 10.66.139.227 with SMTP id rb3mr22379901pab.64.1446479408759; Mon, 02 Nov 2015 07:50:08 -0800 (PST) Received: from [172.26.54.3] ([172.26.54.3]) by smtp.gmail.com with ESMTPSA id er1sm24765521pbb.6.2015.11.02.07.50.07 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 02 Nov 2015 07:50:08 -0800 (PST) Message-ID: <1446479407.23275.12.camel@edumazet-glaptop2.roam.corp.google.com> Subject: [PATCH net] net: avoid NULL deref in inet_ctl_sock_destroy() From: Eric Dumazet To: David Miller Cc: netdev , Dmitry Vyukov Date: Mon, 02 Nov 2015 07:50:07 -0800 X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet Under low memory conditions, tcp_sk_init() and icmp_sk_init() can both iterate on all possible cpus and call inet_ctl_sock_destroy(), with eventual NULL pointer. Signed-off-by: Eric Dumazet Reported-by: Dmitry Vyukov --- include/net/inet_common.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/net/inet_common.h b/include/net/inet_common.h index 279f83591971..109e3ee9108c 100644 --- a/include/net/inet_common.h +++ b/include/net/inet_common.h @@ -41,7 +41,8 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, static inline void inet_ctl_sock_destroy(struct sock *sk) { - sock_release(sk->sk_socket); + if (sk) + sock_release(sk->sk_socket); } #endif