* [PATCH] Correct accept(2) recovery after sock_attach_fd()
@ 2007-03-26 15:34 Alexey Dobriyan
2007-03-26 21:20 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Alexey Dobriyan @ 2007-03-26 15:34 UTC (permalink / raw)
To: netdev; +Cc: devel
* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
---
net/socket.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struc
err = sock_attach_fd(newsock, newfile);
if (err < 0)
- goto out_fd;
+ goto out_fd_simple;
err = security_socket_accept(sock, newsock);
if (err)
@@ -1414,6 +1414,11 @@ out_put:
fput_light(sock->file, fput_needed);
out:
return err;
+out_fd_simple:
+ sock_release(newsock);
+ put_filp(newfile);
+ put_unused_fd(newfd);
+ goto out_put;
out_fd:
fput(newfile);
put_unused_fd(newfd);
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] Correct accept(2) recovery after sock_attach_fd()
2007-03-26 15:34 [PATCH] Correct accept(2) recovery after sock_attach_fd() Alexey Dobriyan
@ 2007-03-26 21:20 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2007-03-26 21:20 UTC (permalink / raw)
To: adobriyan; +Cc: netdev, devel
From: Alexey Dobriyan <adobriyan@sw.ru>
Date: Mon, 26 Mar 2007 19:34:31 +0400
> * d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
> * bail out to out_fd label, doing fput()/__fput() on new file
> * but __fput() assumes valid ->f_dentry and dereferences it
>
> Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Thanks for this bug fix Alexey, patch applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-03-26 21:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-03-26 15:34 [PATCH] Correct accept(2) recovery after sock_attach_fd() Alexey Dobriyan
2007-03-26 21:20 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).