2009-09-14 16:14:00

by David Teigland

[permalink] [raw]
Subject: [PATCH 1/3] dlm: fix double-release of socket in error exit path

From: Casey Dahlin <[email protected]>

The last correction to the tcp_connect_to_sock error exit path,
commit a89d63a159b1ba5833be2bef00adf8ad8caac8be, can free an already
freed socket, due to collision with a previous (incomplete) attempt
to fix the same issue, commit 311f6fc77c51926dbdfbeab0a5d88d70f01fa3f4.

Signed-off-by: Casey Dahlin <[email protected]>
Signed-off-by: David Teigland <[email protected]>
---
fs/dlm/lowcomms.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 618a60f..210d52c 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -926,10 +926,8 @@ static void tcp_connect_to_sock(struct connection *con)
goto out_err;

memset(&saddr, 0, sizeof(saddr));
- if (dlm_nodeid_to_addr(con->nodeid, &saddr)) {
- sock_release(sock);
+ if (dlm_nodeid_to_addr(con->nodeid, &saddr))
goto out_err;
- }

sock->sk->sk_user_data = con;
con->rx_action = receive_from_sock;
--
1.5.5.6