Re: [PATCH v2 3/3] pppoatm: protect against freeing of vcc
From: David Woodhouse <dwmw2@infradead.org>
Date: 2012-10-30 09:39:28
Also in:
lkml
On Mon, 2012-10-22 at 19:14 +0200, Krzysztof Mazur wrote:
The pppoatm gets a reference to atmvcc, but does not increment vcc usage count. The vcc uses vcc->sk socket for reference counting, so sock_hold() and sock_put() should be used by pppoatm. Signed-off-by: Krzysztof Mazur <redacted> Cc: David Woodhouse <dwmw2@infradead.org>
Acked-By: David Woodhouse <redacted> But did you spot what's in the end of the context of the first hunk...?
quoted hunk ↗ jump to hunk
--- a/net/atm/pppoatm.c +++ b/net/atm/pppoatm.c@@ -154,6 +154,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc*atmvcc) tasklet_kill(&pvcc->wakeup_tasklet); ppp_unregister_channel(&pvcc->chan); atmvcc->user_back = NULL; + sock_put(sk_atm(pvcc->atmvcc)); kfree(pvcc); /* Gee, I hope we have the big kernel lock here... */ module_put(THIS_MODULE);
Fairly sure that hope is unfounded these days... :) -- dwmw2
Attachments
- smime.p7s [application/x-pkcs7-signature] 6171 bytes