llc: fix NULL pointer deref for SOCK_ZAPPED
For SOCK_ZAPPED socket, we don't need to care about llc->sap,
so we should just skip these refcount functions in this case.
Fixes: f7e4367268
("llc: hold llc_sap before release_sock()")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
5e391dc5a8
commit
3a04ce7130
|
@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock)
|
|||
{
|
||||
struct sock *sk = sock->sk;
|
||||
struct llc_sock *llc;
|
||||
struct llc_sap *sap;
|
||||
|
||||
if (unlikely(sk == NULL))
|
||||
goto out;
|
||||
|
@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock)
|
|||
llc->laddr.lsap, llc->daddr.lsap);
|
||||
if (!llc_send_disc(sk))
|
||||
llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
|
||||
sap = llc->sap;
|
||||
/* Hold this for release_sock(), so that llc_backlog_rcv() could still
|
||||
* use it.
|
||||
*/
|
||||
llc_sap_hold(sap);
|
||||
if (!sock_flag(sk, SOCK_ZAPPED))
|
||||
if (!sock_flag(sk, SOCK_ZAPPED)) {
|
||||
struct llc_sap *sap = llc->sap;
|
||||
|
||||
/* Hold this for release_sock(), so that llc_backlog_rcv()
|
||||
* could still use it.
|
||||
*/
|
||||
llc_sap_hold(sap);
|
||||
llc_sap_remove_socket(llc->sap, sk);
|
||||
release_sock(sk);
|
||||
llc_sap_put(sap);
|
||||
release_sock(sk);
|
||||
llc_sap_put(sap);
|
||||
} else {
|
||||
release_sock(sk);
|
||||
}
|
||||
if (llc->dev)
|
||||
dev_put(llc->dev);
|
||||
sock_put(sk);
|
||||
|
|
Loading…
Reference in New Issue