James Morris wrote:
> On Thu, 4 Oct 2007, Tony Battersby wrote:
>
>
>> If accept() returns an error, kernel_accept() releases the new socket
>> but passes a pointer to the released socket back to the caller. Make it
>> pass back NULL instead.
>>
>> Signed-off-by: Tony Battersby <[EMAIL PROTECTED]>
>> ---
>> --- linux-2.6.23-rc9/net/socket.c.bak 2007-10-04 15:21:17.000000000
>> -0400
>> +++ linux-2.6.23-rc9/net/socket.c 2007-10-04 15:21:22.000000000 -0400
>> @@ -2230,6 +2230,7 @@ int kernel_accept(struct socket *sock, s
>> err = sock->ops->accept(sock, *newsock, flags);
>> if (err < 0) {
>> sock_release(*newsock);
>> + *newsock = NULL;
>> goto done;
>> }
>>
>>
>
> If you get an error back from kernel_accept, you should not be trying to
> use newsock.
>
>
Here is an example of what I would consider "reasonable code" that would
fail:
int example()
{
struct socket *conn_socket = NULL;
int err;
...
if ((err = kernel_accept(sock, &conn_socket, 0)) < 0)
goto out_cleanup;
[do whatever with conn_socket]
out_cleanup:
if (conn_socket != NULL)
sock_release(&conn_socket);
return err;
}
Without the patch, the double sock_release() will cause a BUG().
Also compare to sock_create_lite(), which sets *res to NULL on error.
Tony
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
