llc: fix NULL pointer deref for SOCK_ZAPPED (3a04ce71) · Commits · 戴 / test

For SOCK_ZAPPED socket, we don't need to care about llc->sap, so we should just skip these refcount functions in this case. Fixes: ("llc: hold llc_sap before release_sock()") Reported-by:

kernel test robot <lkp@intel.com> Signed-off-by:

Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/llc/af_llc.c

+12 −9

Original line number	Diff line number	Diff line
		@@ -189,7 +189,6 @@ static int llc_ui_release(struct socket *sock)
		{
		struct sock *sk = sock->sk;
		struct llc_sock *llc;
		struct llc_sap *sap;

		if (unlikely(sk == NULL))
		goto out;
		@@ -200,15 +199,19 @@ static int llc_ui_release(struct socket *sock)
		llc->laddr.lsap, llc->daddr.lsap);
		if (!llc_send_disc(sk))
		llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
		sap = llc->sap;
		/* Hold this for release_sock(), so that llc_backlog_rcv() could still
		* use it.
		if (!sock_flag(sk, SOCK_ZAPPED)) {
		struct llc_sap *sap = llc->sap;

		/* Hold this for release_sock(), so that llc_backlog_rcv()
		* could still use it.
		*/
		llc_sap_hold(sap);
		if (!sock_flag(sk, SOCK_ZAPPED))
		llc_sap_remove_socket(llc->sap, sk);
		release_sock(sk);
		llc_sap_put(sap);
		} else {
		release_sock(sk);
		}
		if (llc->dev)
		dev_put(llc->dev);
		sock_put(sk);

Admin message