Skip to contentSkip to conversation

Correct accept(2) recovery after sock_attach_fd()

PATCH In review Alexey Dobriyan 2 participants 2 messages Mar 26, 2007

Subsystems (3)
Networking Network drivers Sockets
lore
Share & tools
lore

Alexey Dobriyan

author
#0 lore raw

PATCH 1/1 Correct accept(2) recovery after sock_attach_fd()

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by Alexey Dobriyan <[email protected]>

---

 net/socket.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
net/socket.c +6 -1
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struc
 
 	err = sock_attach_fd(newsock, newfile);
 	if (err < 0)
-		goto out_fd;
+		goto out_fd_simple;
 
 	err = security_socket_accept(sock, newsock);
 	if (err)

@@ -1414,6 +1414,11 @@ out_put:
 	fput_light(sock->file, fput_needed);
 out:
 	return err;
+out_fd_simple:
+	sock_release(newsock);
+	put_filp(newfile);
+	put_unused_fd(newfd);
+	goto out_put;
 out_fd:
 	fput(newfile);
 	put_unused_fd(newfd);
maintainer
#1 lore raw

From: Alexey Dobriyan <[email protected]>
Date: Mon, 26 Mar 2007 19:34:31 +0400

Quoted 5 lines

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by Alexey Dobriyan <[email protected]>

Thanks for this bug fix Alexey, patch applied.