Commit 79f4f642 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller

[NET]: Correct accept(2) recovery after sock_attach_fd()

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it
Signed-off-by: default avatarAlexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 165de5b7
...@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, ...@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
err = sock_attach_fd(newsock, newfile); err = sock_attach_fd(newsock, newfile);
if (err < 0) if (err < 0)
goto out_fd; goto out_fd_simple;
err = security_socket_accept(sock, newsock); err = security_socket_accept(sock, newsock);
if (err) if (err)
...@@ -1414,6 +1414,11 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, ...@@ -1414,6 +1414,11 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
fput_light(sock->file, fput_needed); fput_light(sock->file, fput_needed);
out: out:
return err; return err;
out_fd_simple:
sock_release(newsock);
put_filp(newfile);
put_unused_fd(newfd);
goto out_put;
out_fd: out_fd:
fput(newfile); fput(newfile);
put_unused_fd(newfd); put_unused_fd(newfd);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment