summaryrefslogtreecommitdiffstats
path: root/net/phonet
diff options
context:
space:
mode:
authorRémi Denis-Courmont <remi.denis-courmont@nokia.com>2010-05-26 00:44:44 +0000
committerDavid S. Miller <davem@davemloft.net>2010-05-29 00:18:50 -0700
commit7dfde179c38056b91d51e60f3d50902387f27c84 (patch)
treeca53c26f8290127f2199e387987c176402483a55 /net/phonet
parent97dc875f90a7b88a9fa476c256345c0d40fcdf6c (diff)
downloadlinux-stable-7dfde179c38056b91d51e60f3d50902387f27c84.tar.gz
linux-stable-7dfde179c38056b91d51e60f3d50902387f27c84.tar.bz2
linux-stable-7dfde179c38056b91d51e60f3d50902387f27c84.zip
Phonet: listening socket lock protects the connected socket list
The accept()'d socket need to be unhashed while the (listen()'ing) socket lock is held. This fixes a race condition that could lead to an OOPS. Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/phonet')
-rw-r--r--net/phonet/pep.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7b048a35ca58..94d72e85a475 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk)
lock_sock(sk);
if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
skparent = pn->listener;
- sk_del_node_init(sk);
release_sock(sk);
- sk = skparent;
pn = pep_sk(skparent);
- lock_sock(sk);
+ lock_sock(skparent);
+ sk_del_node_init(sk);
+ sk = skparent;
}
/* Unhash a listening sock only when it is closed
* and all of its active connected pipes are closed. */