From: Alexey Dobriyan <adobriyan@sw.ru>
Date: Thu, 29 Mar 2007 19:22:40 +0000 (-0700)
Subject: NET: Fix sock_attach_fd() failure in sys_accept()
X-Git-Tag: v2.6.20.5~23
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=4870b7bf2ed1ffb316bd57ed8172e384ab186d6a;p=karo-tx-linux.git

NET: Fix sock_attach_fd() failure in sys_accept()

[NET]: Correct accept(2) recovery after sock_attach_fd()

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/net/socket.c b/net/socket.c
index 4e396312f8d5..afb6085827ca 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1368,7 +1368,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 
 	err = sock_attach_fd(newsock, newfile);
 	if (err < 0)
-		goto out_fd;
+		goto out_fd_simple;
 
 	err = security_socket_accept(sock, newsock);
 	if (err)
@@ -1401,6 +1401,11 @@ out_put:
 	fput_light(sock->file, fput_needed);
 out:
 	return err;
+out_fd_simple:
+	sock_release(newsock);
+	put_filp(newfile);
+	put_unused_fd(newfd);
+	goto out_put;
 out_fd:
 	fput(newfile);
 	put_unused_fd(newfd);