]> git.proxmox.com Git - mirror_ubuntu-disco-kernel.git/commitdiff
Phonet: fix potential use-after-free in pep_sock_close()
authorRémi Denis-Courmont <remi.denis-courmont@nokia.com>
Tue, 25 May 2010 23:08:39 +0000 (16:08 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 25 May 2010 23:08:39 +0000 (16:08 -0700)
sk_common_release() might destroy our last reference to the socket.
So an extra temporary reference is needed during cleanup.

Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/phonet/pep.c

index af4d38bc3b2231135a60974a53038d306b110961..7b048a35ca5837368e4ace101a57564eacbb51fc 100644 (file)
@@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
        struct pep_sock *pn = pep_sk(sk);
        int ifindex = 0;
 
+       sock_hold(sk); /* keep a reference after sk_common_release() */
        sk_common_release(sk);
 
        lock_sock(sk);
@@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
 
        if (ifindex)
                gprs_detach(sk);
+       sock_put(sk);
 }
 
 static int pep_wait_connreq(struct sock *sk, int noblock)