Re: [PATCH] net: fix kernel_accept() error path

[David Miller <davem@davemloft.net>]

From: James Morris <jmorris@namei.org>
Date: Thu, 4 Oct 2007 14:57:33 -0700 (PDT)

> On Thu, 4 Oct 2007, Tony Battersby wrote:
> 
> > If accept() returns an error, kernel_accept() releases the new socket
> > but passes a pointer to the released socket back to the caller.  Make it
> > pass back NULL instead.
> > 
> > Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
> > ---
> > --- linux-2.6.23-rc9/net/socket.c.bak	2007-10-04 15:21:17.000000000 -0400
> > +++ linux-2.6.23-rc9/net/socket.c	2007-10-04 15:21:22.000000000 -0400
> > @@ -2230,6 +2230,7 @@ int kernel_accept(struct socket *sock, s
> >  	err = sock->ops->accept(sock, *newsock, flags);
> >  	if (err < 0) {
> >  		sock_release(*newsock);
> > +		*newsock = NULL;
> >  		goto done;
> >  	}
> >  
> 
> If you get an error back from kernel_accept, you should not be trying to 
> use newsock.

Agreed, the caller should not try to deref the thing, it's
value is undefined.