[patch 16/37] NET: Fix sock_attach_fd() failure in sys_accept()

Greg KH
2007-03-30T21:19:00Z

[-- Attachment #1: net-fix-sock_attach_fd-failure-in-sys_accept.patch --]
[-- Type: text/plain, Size: 1133 bytes --]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alexey Dobriyan <adobriyan@sw.ru>

[NET]: Correct accept(2) recovery after sock_attach_fd()

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/socket.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- a/net/socket.c
+++ b/net/socket.c
@@ -1368,7 +1368,7 @@ asmlinkage long sys_accept(int fd, struc

err = sock_attach_fd(newsock, newfile);
if (err < 0)
- goto out_fd;
+ goto out_fd_simple;

err = security_socket_accept(sock, newsock);
if (err)
@@ -1401,6 +1401,11 @@ out_put:
fput_light(sock->file, fput_needed);
out:
return err;
+out_fd_simple:
+ sock_release(newsock);
+ put_filp(newfile);
+ put_unused_fd(newfd);
+ goto out_put;
out_fd:
fput(newfile);
put_unused_fd(newfd);

--