| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1274796709-29988-1-git-send-email-remi.denis-courmont@nokia.com> Date: Tue, 25 May 2010 17:11:49 +0300 From: Rémi Denis-Courmont <remi.denis-courmont@...ia.com> To: netdev@...r.kernel.org Subject: [PATCH net] Phonet: fix potential use-after-free in pep_sock_close() From: Rémi Denis-Courmont <remi.denis-courmont@...ia.com> sk_common_release() might destroy our last reference to the socket. So an extra temporary reference is needed during cleanup. Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@...ia.com> --- net/phonet/pep.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index af4d38b..7b048a3 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -626,6 +626,7 @@ static void pep_sock_close(struct sock *sk, long timeout) struct pep_sock *pn = pep_sk(sk); int ifindex = 0; + sock_hold(sk); /* keep a reference after sk_common_release() */ sk_common_release(sk); lock_sock(sk); @@ -644,6 +645,7 @@ static void pep_sock_close(struct sock *sk, long timeout) if (ifindex) gprs_detach(sk); + sock_put(sk); } static int pep_wait_connreq(struct sock *sk, int noblock) -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists