Re: [PATCH v2 3/3] pppoatm: protect against freeing of vcc

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 1007 bytes --]

On Mon, 2012-10-22 at 19:14 +0200, Krzysztof Mazur wrote:
> The pppoatm gets a reference to atmvcc, but does not increment vcc
> usage count. The vcc uses vcc->sk socket for reference counting,
> so sock_hold() and sock_put() should be used by pppoatm.
> 
> Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
> Cc: David Woodhouse <dwmw2@infradead.org>

Acked-By: David Woodhouse <David.Woodhouse@intel.com>

But did you spot what's in the end of the context of the first hunk...?

> --- a/net/atm/pppoatm.c
> +++ b/net/atm/pppoatm.c
> @@ -154,6 +154,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc
> *atmvcc)
>         tasklet_kill(&pvcc->wakeup_tasklet);
>         ppp_unregister_channel(&pvcc->chan);
>         atmvcc->user_back = NULL;
> +       sock_put(sk_atm(pvcc->atmvcc));
>         kfree(pvcc);
>         /* Gee, I hope we have the big kernel lock here... */
>         module_put(THIS_MODULE);

Fairly sure that hope is unfounded these days... :)

-- 
dwmw2


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 6171 bytes --]