diff options
| author | Rémi Denis-Courmont <remi.denis-courmont@nokia.com> | 2010-05-25 16:08:39 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-05-25 16:08:39 -0700 |
| commit | e513480e28cdfd868755f05c1a654fcfcee58070 (patch) | |
| tree | 53fd9bf4786dc56843641912fdc260c1b76f1613 /net/phonet | |
| parent | 7466a38478a30d5f7248134c9bdcb4e1c01fe4d9 (diff) | |
Phonet: fix potential use-after-free in pep_sock_close()
sk_common_release() might destroy our last reference to the socket.
So an extra temporary reference is needed during cleanup.
Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/phonet')
| -rw-r--r-- | net/phonet/pep.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/phonet/pep.c b/net/phonet/pep.c index af4d38bc3b2..7b048a35ca5 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout) struct pep_sock *pn = pep_sk(sk); int ifindex = 0; + sock_hold(sk); /* keep a reference after sk_common_release() */ sk_common_release(sk); lock_sock(sk); @@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout) if (ifindex) gprs_detach(sk); + sock_put(sk); } static int pep_wait_connreq(struct sock *sk, int noblock) |