Commit 8fa677d2 authored Nov 02, 2015 by Eric Dumazet Committed by David S. Miller Nov 02, 2015

net: avoid NULL deref in inet_ctl_sock_destroy()



Under low memory conditions, tcp_sk_init() and icmp_sk_init()
can both iterate on all possible cpus and call inet_ctl_sock_destroy(),
with eventual NULL pointer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ec13ad1d

include/net/inet_common.h

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -41,6 +41,7 @@ int inet_recv_error(struct sock sk, struct msghdr msg, int len,

	static inline void inet_ctl_sock_destroy(struct sock *sk)		static inline void inet_ctl_sock_destroy(struct sock *sk)
	{		{
			if (sk)
	sock_release(sk->sk_socket);		sock_release(sk->sk_socket);
	}		}