* [PATCH v2] net/unix: sk_socket can disappear when state is unlocked
@ 2015-05-22 15:00 Mark Salyzyn
0 siblings, 0 replies; only message in thread
From: Mark Salyzyn @ 2015-05-22 15:00 UTC (permalink / raw)
To: linux-kernel
Cc: Hannes Frederic Sowa, Mark Salyzyn, Dmitry Tarnyagin,
David S. Miller, Al Viro, David Howells, Ying Xue,
Christoph Hellwig, netdev
got a rare NULL pointer dereference in clear_bit
Signed-off-by: Mark Salyzyn <salyzyn@android.com>
----
v2: switch to sock_flag(sk, SOCK_DEAD) and added net/caif/caif_socket.c
net/caif/caif_socket.c | 4 ++++
net/unix/af_unix.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 4ec0c80..8f44c38 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -330,6 +330,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
release_sock(sk);
timeo = schedule_timeout(timeo);
lock_sock(sk);
+
+ if (sock_flag(sk, SOCK_DEAD))
+ break;
+
clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
}
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 5266ea7..7b68dc8 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1880,6 +1880,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
unix_state_unlock(sk);
timeo = freezable_schedule_timeout(timeo);
unix_state_lock(sk);
+
+ if (sock_flag(sk, SOCK_DEAD))
+ break;
+
clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
}
--
2.2.0.rc0.207.ga3a616c
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-05-22 15:00 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-05-22 15:00 [PATCH v2] net/unix: sk_socket can disappear when state is unlocked Mark Salyzyn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).