Module: xenomai-gch
Branch: for-forge
Commit: 202dd729a7aa0e80f7e92f92dcba60e0ed810587
URL:    
http://git.xenomai.org/?p=xenomai-gch.git;a=commit;h=202dd729a7aa0e80f7e92f92dcba60e0ed810587

Author: Gilles Chanteperdrix <gilles.chanteperd...@xenomai.org>
Date:   Tue Sep 29 23:09:31 2015 +0200

rtnet/icmp: reference socket in icmp_dest_socket()

Otherwise when rt_ip_rcv() dereferences the socket, its fake reference
count reaches 0, which causes a destruction of the nonexistent file
descriptor associated with this fake icmp socket. Ending up with a
kernel oops in fd_cleanup_thread().

---

 kernel/drivers/net/stack/ipv4/icmp.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/drivers/net/stack/ipv4/icmp.c 
b/kernel/drivers/net/stack/ipv4/icmp.c
index 4b83942..b6ae736 100644
--- a/kernel/drivers/net/stack/ipv4/icmp.c
+++ b/kernel/drivers/net/stack/ipv4/icmp.c
@@ -446,8 +446,7 @@ static struct rt_icmp_control 
rt_icmp_pointers[NR_ICMP_TYPES+1] =
  */
 struct rtsocket *rt_icmp_dest_socket(struct rtskb *skb)
 {
-    /* Note that the socket's refcount is not used by this protocol.
-     * The socket returned here is static and not part of the global pool. */
+    rt_socket_reference(icmp_socket);
     return icmp_socket;
 }
 


_______________________________________________
Xenomai-git mailing list
Xenomai-git@xenomai.org
http://xenomai.org/mailman/listinfo/xenomai-git

Reply via email to