Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 357c4774 authored by Sasha Levin's avatar Sasha Levin Committed by David S. Miller
Browse files

tipc: correctly handle releasing a not fully initialized sock 



Commit f2f9800d "tipc: make tipc node table aware of net
namespace" has added a dereference of sock->sk before making sure it's
not NULL, which makes releasing a tipc socket NULL pointer dereference
for sockets that are not fully initialized.

Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 86cfeab6

net/tipc/socket.c

+5 −2
Original line number Diff line number Diff line
@@ -470,8 +470,8 @@ static void tipc_sk_callback(struct rcu_head *head) 
static int tipc_release(struct socket *sock)

{

	struct sock *sk = sock->sk;

	struct net *net = sock_net(sk);

	struct tipc_net *tn = net_generic(net, tipc_net_id);

	struct net *net;

	struct tipc_net *tn;

	struct tipc_sock *tsk;

	struct sk_buff *skb;

	u32 dnode, probing_state;
@@ -483,6 +483,9 @@ static int tipc_release(struct socket *sock) 
	if (sk == NULL)

		return 0;



	net = sock_net(sk);

	tn = net_generic(net, tipc_net_id);



	tsk = tipc_sk(sk);

	lock_sock(sk);