[PATCH] (11/11) netrom - fix use after free in close

• Previous message: Stephen Hemminger: "[PATCH] (9/11) netrom - convert to alloc_netdev"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

netrom would oops if one did:
        modprobe netrom
        ifconfig -a

because the code in destroy was freeing the socket then release_sock was
called.

diff -Nru a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
--- a/net/netrom/af_netrom.c Wed Aug 13 15:33:26 2003
+++ b/net/netrom/af_netrom.c Wed Aug 13 15:33:26 2003
@@ -516,6 +516,7 @@
 
         if (sk == NULL) return 0;
 
+ sock_hold(sk);
         lock_sock(sk);
         nr = nr_sk(sk);
 
@@ -551,6 +552,7 @@
 
         sock->sk = NULL;
         release_sock(sk);
+ sock_put(sk);
 
         return 0;
 }
-
To unsubscribe from this list: send the line "unsubscribe linux-hams" in
the body of a message to terhi.victor@logonet.com
More majordomo info at http://vger.kernel.org/majordomo-info.html

• Next message: Stephen Hemminger: "[PATCH] (7/11) netrom - convert route/node tables to hlist"
• Previous message: Stephen Hemminger: "[PATCH] (9/11) netrom - convert to alloc_netdev"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Aug 14 2003 - 01:49:16 EEST