diff options
| author | Rémi Denis-Courmont <remi.denis-courmont@nokia.com> | 2010-05-26 02:44:44 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-05-29 09:18:50 +0200 |
| commit | 7dfde179c38056b91d51e60f3d50902387f27c84 (patch) | |
| tree | ca53c26f8290127f2199e387987c176402483a55 /net/phonet | |
| parent | caif: unlock on error path in cfserl_receive() (diff) | |
| download | linux-7dfde179c38056b91d51e60f3d50902387f27c84.tar.xz linux-7dfde179c38056b91d51e60f3d50902387f27c84.zip | |
Phonet: listening socket lock protects the connected socket list
The accept()'d socket need to be unhashed while the (listen()'ing)
socket lock is held. This fixes a race condition that could lead to an
OOPS.
Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/phonet')
| -rw-r--r-- | net/phonet/pep.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 7b048a35ca58..94d72e85a475 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk) lock_sock(sk); if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) { skparent = pn->listener; - sk_del_node_init(sk); release_sock(sk); - sk = skparent; pn = pep_sk(skparent); - lock_sock(sk); + lock_sock(skparent); + sk_del_node_init(sk); + sk = skparent; } /* Unhash a listening sock only when it is closed * and all of its active connected pipes are closed. */ |