NFC: Close a race condition in llcp_sock_getname()

[karo-tx-linux.git] / net / nfc / llcp_sock.c

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ecf0a0196f18040fb3fb2dc21b79273da92a470e..b9edf5fae6ae979689ce9a5fc16f8f1aaf626137 100644 (file)
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -509,6 +509,11 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
        memset(llcp_addr, 0, sizeof(*llcp_addr));
        *len = sizeof(struct sockaddr_nfc_llcp);
 
+       lock_sock(sk);
+       if (!llcp_sock->dev) {
+               release_sock(sk);
+               return -EBADFD;
+       }
        llcp_addr->sa_family = AF_NFC;
        llcp_addr->dev_idx = llcp_sock->dev->idx;
        llcp_addr->target_idx = llcp_sock->target_idx;
@@ -518,6 +523,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
        llcp_addr->service_name_len = llcp_sock->service_name_len;
        memcpy(llcp_addr->service_name, llcp_sock->service_name,
               llcp_addr->service_name_len);
+       release_sock(sk);
 
        return 0;
 }