Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Phonet: fix potential use-after-free in pep_sock_close()

Browse source 
sk_common_release() might destroy our last reference to the socket.
So an extra temporary reference is needed during cleanup.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Rémi Denis-Courmont 2010-05-25 16:08:39 -07:00 committed by David S. Miller
parent 7466a38478
commit e513480e28
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/phonet/pep.c
View file

@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
struct pep_sock *pn = pep_sk(sk); struct pep_sock *pn = pep_sk(sk);
int ifindex = 0; int ifindex = 0;
sock_hold(sk); /* keep a reference after sk_common_release() */
sk_common_release(sk); sk_common_release(sk);
lock_sock(sk); lock_sock(sk);
@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
if (ifindex) if (ifindex)
gprs_detach(sk); gprs_detach(sk);
sock_put(sk);
} }
static int pep_wait_connreq(struct sock *sk, int noblock) static int pep_wait_connreq(struct sock *sk, int noblock)