> -----Original Message----- > From: Cong Wang [mailto:[email protected]] > Sent: Monday, December 04, 2017 14:41 > To: David Miller <[email protected]> > Cc: Linux Kernel Network Developers <[email protected]>; tipc- > [email protected]; Jon Maloy <[email protected]>; > Ying Xue <[email protected]> > Subject: Re: [Patch net v2] tipc: fix a null pointer deref on error path > > On Mon, Dec 4, 2017 at 11:23 AM, Cong Wang <[email protected]> > wrote: > > On Mon, Dec 4, 2017 at 10:57 AM, David Miller <[email protected]> > wrote: > >> > >> It looks like tipc_accept_from_sock() has a similar problem? The > >> tipc_close_conn() will get invoked indirectly from the sock_release() > >> path right? > > > > Not sure, the sock_release() in tipc_accept_from_sock() is for > > kernel_accept(), not for tipc_alloc_conn(). Or maybe it is hiding deep > > in the call chain that I miss? > > I see: > > tipc_release() -> tipc_sk_leave() -> tipc_group_delete() > -> tipc_topsrv_kern_unsubscr() -> tipc_close_conn() > > Seems on this path we do need to skip NULL too.
You are right. The right solution is to just call conn_put() twice here. I already have a patch ready for this, but it is part of a series that needs more review. I should probably post it separately... ///jon ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ tipc-discussion mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tipc-discussion
