Phonet: hold socket before giving it to sk_deliver_skb()
authorRémi Denis-Courmont <remi.denis-courmont@nokia.com>
Thu, 15 Oct 2009 19:29:14 +0000 (12:29 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Oct 2009 19:30:42 +0000 (12:30 -0700)
Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/phonet/socket.c

index 8c84190f22debbe868c5eb6e5648aa4f09f23e29..0412beb59a05b3196f3c3466bfd615098094d527 100644 (file)
@@ -112,8 +112,10 @@ void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
                        continue;
 
                clone = skb_clone(skb, GFP_ATOMIC);
                        continue;
 
                clone = skb_clone(skb, GFP_ATOMIC);
-               if (clone)
+               if (clone) {
+                       sock_hold(sknode);
                        sk_receive_skb(sknode, clone, 0);
                        sk_receive_skb(sknode, clone, 0);
+               }
        }
        spin_unlock(&pnsocks.lock);
 }
        }
        spin_unlock(&pnsocks.lock);
 }