* [PATCH net] Phonet: fix potential use-after-free in pep_sock_close()
@ 2010-05-25 14:11 Rémi Denis-Courmont
2010-05-25 23:08 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Rémi Denis-Courmont @ 2010-05-25 14:11 UTC (permalink / raw)
To: netdev
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
sk_common_release() might destroy our last reference to the socket.
So an extra temporary reference is needed during cleanup.
Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
---
net/phonet/pep.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index af4d38b..7b048a3 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
struct pep_sock *pn = pep_sk(sk);
int ifindex = 0;
+ sock_hold(sk); /* keep a reference after sk_common_release() */
sk_common_release(sk);
lock_sock(sk);
@@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
if (ifindex)
gprs_detach(sk);
+ sock_put(sk);
}
static int pep_wait_connreq(struct sock *sk, int noblock)
--
1.7.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] Phonet: fix potential use-after-free in pep_sock_close()
2010-05-25 14:11 [PATCH net] Phonet: fix potential use-after-free in pep_sock_close() Rémi Denis-Courmont
@ 2010-05-25 23:08 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2010-05-25 23:08 UTC (permalink / raw)
To: remi.denis-courmont; +Cc: netdev
From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Date: Tue, 25 May 2010 17:11:49 +0300
> sk_common_release() might destroy our last reference to the socket.
> So an extra temporary reference is needed during cleanup.
>
> Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Patch applied, thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-05-25 23:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-25 14:11 [PATCH net] Phonet: fix potential use-after-free in pep_sock_close() Rémi Denis-Courmont
2010-05-25 23:08 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).