diff options
| author | Lorenzo Colitti <lorenzo@google.com> | 2015-09-15 00:14:23 +0900 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-23 21:15:32 -0700 |
| commit | 21af70100c620839082e3b05f0d86354f194180e (patch) | |
| tree | 4bebd01fa4058be7c0590f3277e7890667a79835 /include/linux/timerqueue.h | |
| parent | f10ced0ba55975876f4db92b052dd84a603be92d (diff) | |
Fix NULL pointer dereference in tcp_nuke_addr.
tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.
Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 74d66ee756afcc3269e4c1341f793c52be629af9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions