diff options
| author | Alexey Dobriyan <adobriyan@sw.ru> | 2007-03-26 14:09:52 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-03-26 14:09:52 -0700 |
| commit | 79f4f6428f6ceb9af57330092271bda028c23a96 (patch) | |
| tree | e73a452517b3e6f8cc5c583a3e0174b039ccc5a2 /net/socket.c | |
| parent | 165de5b7f2719c1984956504128545839762d635 (diff) | |
| download | lwn-79f4f6428f6ceb9af57330092271bda028c23a96.tar.gz lwn-79f4f6428f6ceb9af57330092271bda028c23a96.zip | |
[NET]: Correct accept(2) recovery after sock_attach_fd()
* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/socket.c')
| -rw-r--r-- | net/socket.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/socket.c b/net/socket.c index 9566e57ac7f5..ea8f81abc45c 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, err = sock_attach_fd(newsock, newfile); if (err < 0) - goto out_fd; + goto out_fd_simple; err = security_socket_accept(sock, newsock); if (err) @@ -1414,6 +1414,11 @@ out_put: fput_light(sock->file, fput_needed); out: return err; +out_fd_simple: + sock_release(newsock); + put_filp(newfile); + put_unused_fd(newfd); + goto out_put; out_fd: fput(newfile); put_unused_fd(newfd); |