[PATCH v2 3/3] pppoatm: protect against freeing of vcc
From: Krzysztof Mazur <hidden>
Date: 2012-10-22 17:24:20
Also in:
lkml
Subsystem:
atm, networking [general], ppp over atm (rfc 2364), the rest · Maintainers:
Chas Williams, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Mitchell Blank Jr, Linus Torvalds
The pppoatm gets a reference to atmvcc, but does not increment vcc usage count. The vcc uses vcc->sk socket for reference counting, so sock_hold() and sock_put() should be used by pppoatm. Signed-off-by: Krzysztof Mazur <redacted> Cc: David Woodhouse <dwmw2@infradead.org> --- net/atm/pppoatm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index e3b2d69..a766d96 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c@@ -154,6 +154,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc *atmvcc) tasklet_kill(&pvcc->wakeup_tasklet); ppp_unregister_channel(&pvcc->chan); atmvcc->user_back = NULL; + sock_put(sk_atm(pvcc->atmvcc)); kfree(pvcc); /* Gee, I hope we have the big kernel lock here... */ module_put(THIS_MODULE);
@@ -373,6 +374,7 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg) if (pvcc == NULL) return -ENOMEM; pvcc->atmvcc = atmvcc; + sock_hold(sk_atm(atmvcc)); /* Maximum is zero, so that we can use atomic_inc_not_zero() */ atomic_set(&pvcc->inflight, NONE_INFLIGHT);
@@ -387,6 +389,7 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg) pvcc->wakeup_tasklet.data = (unsigned long) &pvcc->chan; err = ppp_register_channel(&pvcc->chan); if (err != 0) { + sock_put(sk_atm(atmvcc)); kfree(pvcc); return err; }
--
1.8.0.2.g35080e9