[PATCH net 1/1] Phonet: listening socket lock protects the connected socket list

[PATCH net 1/1] Phonet: listening socket lock protects the connected socket list

[Rémi Denis-Courmont]

From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

The accept()'d socket need to be unhashed while the (listen()'ing)
socket lock is held. This fixes a race condition that could lead to an
OOPS.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
---
 net/phonet/pep.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7b048a3..94d72e8 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk)
 	lock_sock(sk);
 	if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
 		skparent = pn->listener;
-		sk_del_node_init(sk);
 		release_sock(sk);
 
-		sk = skparent;
 		pn = pep_sk(skparent);
-		lock_sock(sk);
+		lock_sock(skparent);
+		sk_del_node_init(sk);
+		sk = skparent;
 	}
 	/* Unhash a listening sock only when it is closed
 	 * and all of its active connected pipes are closed. */
-- 
1.7.0.4

Re: [PATCH net 1/1] Phonet: listening socket lock protects the connected socket list

[David Miller]

From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Date: Wed, 26 May 2010 13:44:44 +0300

> From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
> 
> The accept()'d socket need to be unhashed while the (listen()'ing)
> socket lock is held. This fixes a race condition that could lead to an
> OOPS.
> 
> Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>

Applied.