Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79f4f642 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller
Browse files

[NET]: Correct accept(2) recovery after sock_attach_fd() 



* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 165de5b7

net/socket.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, 




	err = sock_attach_fd(newsock, newfile);

	err = sock_attach_fd(newsock, newfile);

	if (err < 0)

	if (err < 0)

		goto out_fd;

		goto out_fd_simple;





	err = security_socket_accept(sock, newsock);

	err = security_socket_accept(sock, newsock);

	if (err)

	if (err)
@@ -1414,6 +1414,11 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, 
	fput_light(sock->file, fput_needed);

	fput_light(sock->file, fput_needed);

out:

out:

	return err;

	return err;

out_fd_simple:

	sock_release(newsock);

	put_filp(newfile);

	put_unused_fd(newfd);

	goto out_put;

out_fd:

out_fd:

	fput(newfile);

	fput(newfile);

	put_unused_fd(newfd);

	put_unused_fd(newfd);