diff options
| author | Alexey Dobriyan <adobriyan@sw.ru> | 2007-03-29 12:22:40 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2007-04-06 03:43:14 -0700 |
| commit | 4870b7bf2ed1ffb316bd57ed8172e384ab186d6a (patch) | |
| tree | 4deb448944af42bce60212a0e4a5d5ee03a1a1db /net | |
| parent | cb8b4fce39de35071349352c004d930bf9266624 (diff) | |
NET: Fix sock_attach_fd() failure in sys_accept()
[NET]: Correct accept(2) recovery after sock_attach_fd()
* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net')
| -rw-r--r-- | net/socket.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/socket.c b/net/socket.c index 4e396312f8d..afb6085827c 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1368,7 +1368,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, err = sock_attach_fd(newsock, newfile); if (err < 0) - goto out_fd; + goto out_fd_simple; err = security_socket_accept(sock, newsock); if (err) @@ -1401,6 +1401,11 @@ out_put: fput_light(sock->file, fput_needed); out: return err; +out_fd_simple: + sock_release(newsock); + put_filp(newfile); + put_unused_fd(newfd); + goto out_put; out_fd: fput(newfile); put_unused_fd(newfd); |