[NET]: Correct accept(2) recovery after sock_attach_fd()

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/socket.c b/net/socket.c
index 9566e57ac7f58175a71021c5959a6c81e7b426f5..ea8f81abc45cee0dcc69e6375c37d109d31ab807 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 
        err = sock_attach_fd(newsock, newfile);
        if (err < 0)
-               goto out_fd;
+               goto out_fd_simple;
 
        err = security_socket_accept(sock, newsock);
        if (err)
@@ -1414,6 +1414,11 @@ out_put:
        fput_light(sock->file, fput_needed);
 out:
        return err;
+out_fd_simple:
+       sock_release(newsock);
+       put_filp(newfile);
+       put_unused_fd(newfd);
+       goto out_put;
 out_fd:
        fput(newfile);
        put_unused_fd(newfd);