lkml.org 
[lkml]   [2020]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 090/101] net/x25: Fix null-ptr-deref in x25_connect
    Date
    From: Martin Schiller <ms@dev.tdt.de>

    [ Upstream commit 361182308766a265b6c521879b34302617a8c209 ]

    This fixes a regression for blocking connects introduced by commit
    4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect").

    The x25->neighbour is already set to "NULL" by x25_disconnect() now,
    while a blocking connect is waiting in
    x25_wait_for_connection_establishment(). Therefore x25->neighbour must
    not be accessed here again and x25->state is also already set to
    X25_STATE_0 by x25_disconnect().

    Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
    Signed-off-by: Martin Schiller <ms@dev.tdt.de>
    Reviewed-by: Xie He <xie.he.0141@gmail.com>
    Link: https://lore.kernel.org/r/20201109065449.9014-1-ms@dev.tdt.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/x25/af_x25.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/x25/af_x25.c
    +++ b/net/x25/af_x25.c
    @@ -824,7 +824,7 @@ static int x25_connect(struct socket *so
    sock->state = SS_CONNECTED;
    rc = 0;
    out_put_neigh:
    - if (rc) {
    + if (rc && x25->neighbour) {
    read_lock_bh(&x25_list_lock);
    x25_neigh_put(x25->neighbour);
    x25->neighbour = NULL;

    \
     
     \ /
      Last update: 2020-11-17 14:39    [W:5.042 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site