Commit 3a04ce71 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller

llc: fix NULL pointer deref for SOCK_ZAPPED

For SOCK_ZAPPED socket, we don't need to care about llc->sap,
so we should just skip these refcount functions in this case.

Fixes: f7e43672 ("llc: hold llc_sap before release_sock()")
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5e391dc5
...@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock) ...@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
struct llc_sock *llc; struct llc_sock *llc;
struct llc_sap *sap;
if (unlikely(sk == NULL)) if (unlikely(sk == NULL))
goto out; goto out;
...@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock) ...@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock)
llc->laddr.lsap, llc->daddr.lsap); llc->laddr.lsap, llc->daddr.lsap);
if (!llc_send_disc(sk)) if (!llc_send_disc(sk))
llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo); llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
sap = llc->sap; if (!sock_flag(sk, SOCK_ZAPPED)) {
/* Hold this for release_sock(), so that llc_backlog_rcv() could still struct llc_sap *sap = llc->sap;
* use it.
*/ /* Hold this for release_sock(), so that llc_backlog_rcv()
llc_sap_hold(sap); * could still use it.
if (!sock_flag(sk, SOCK_ZAPPED)) */
llc_sap_hold(sap);
llc_sap_remove_socket(llc->sap, sk); llc_sap_remove_socket(llc->sap, sk);
release_sock(sk); release_sock(sk);
llc_sap_put(sap); llc_sap_put(sap);
} else {
release_sock(sk);
}
if (llc->dev) if (llc->dev)
dev_put(llc->dev); dev_put(llc->dev);
sock_put(sk); sock_put(sk);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment