Phonet: fix potential use-after-free in pep_sock_close()
sk_common_release() might destroy our last reference to the socket. So an extra temporary reference is needed during cleanup. Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7466a38478
commit
e513480e28
|
@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
|
|||
struct pep_sock *pn = pep_sk(sk);
|
||||
int ifindex = 0;
|
||||
|
||||
sock_hold(sk); /* keep a reference after sk_common_release() */
|
||||
sk_common_release(sk);
|
||||
|
||||
lock_sock(sk);
|
||||
|
@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout)
|
|||
|
||||
if (ifindex)
|
||||
gprs_detach(sk);
|
||||
sock_put(sk);
|
||||
}
|
||||
|
||||
static int pep_wait_connreq(struct sock *sk, int noblock)
|
||||
|
|
Loading…
Reference in a new issue