Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a04ce71 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

llc: fix NULL pointer deref for SOCK_ZAPPED 



For SOCK_ZAPPED socket, we don't need to care about llc->sap,
so we should just skip these refcount functions in this case.

Fixes: f7e43672 ("llc: hold llc_sap before release_sock()")
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5e391dc5

net/llc/af_llc.c

+12 −9
Original line number Original line Diff line number Diff line
@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock) 
{

{

	struct sock *sk = sock->sk;

	struct sock *sk = sock->sk;

	struct llc_sock *llc;

	struct llc_sock *llc;

	struct llc_sap *sap;





	if (unlikely(sk == NULL))

	if (unlikely(sk == NULL))

		goto out;

		goto out;
@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock) 
		llc->laddr.lsap, llc->daddr.lsap);

		llc->laddr.lsap, llc->daddr.lsap);

	if (!llc_send_disc(sk))

	if (!llc_send_disc(sk))

		llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);

		llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);

	sap = llc->sap;

	if (!sock_flag(sk, SOCK_ZAPPED)) {

	/* Hold this for release_sock(), so that llc_backlog_rcv() could still

		struct llc_sap *sap = llc->sap;

	 * use it.



		/* Hold this for release_sock(), so that llc_backlog_rcv()

		 * could still use it.

		 */

		 */

		llc_sap_hold(sap);

		llc_sap_hold(sap);

	if (!sock_flag(sk, SOCK_ZAPPED))

		llc_sap_remove_socket(llc->sap, sk);

		llc_sap_remove_socket(llc->sap, sk);

		release_sock(sk);

		release_sock(sk);

		llc_sap_put(sap);

		llc_sap_put(sap);

	} else {

		release_sock(sk);

	}

	if (llc->dev)

	if (llc->dev)

		dev_put(llc->dev);

		dev_put(llc->dev);

	sock_put(sk);

	sock_put(sk);