Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7dfde179 authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont Committed by David S. Miller
Browse files

Phonet: listening socket lock protects the connected socket list 



The accept()'d socket need to be unhashed while the (listen()'ing)
socket lock is held. This fixes a race condition that could lead to an
OOPS.

Signed-off-by: default avatarRémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 97dc875f

net/phonet/pep.c

+3 −3
Original line number Diff line number Diff line
@@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk) 
	lock_sock(sk);

	if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {

		skparent = pn->listener;

		sk_del_node_init(sk);

		release_sock(sk);



		sk = skparent;

		pn = pep_sk(skparent);

		lock_sock(sk);

		lock_sock(skparent);

		sk_del_node_init(sk);

		sk = skparent;

	}

	/* Unhash a listening sock only when it is closed

	 * and all of its active connected pipes are closed. */