ipv4: Missing sk_nulls_node_init() in ping_unhash().

If we don't do that, then the poison value is left in the ->pprev backlink. This can cause crashes if we do a disconnect, followed by a connect(). Change-Id: I8ce5297bbde2de3c3d917a690bf5de1b2dc566e8 Tested-by: Linus Torvalds <[email protected]> Reported-by: Wen Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]> Git-commit: a134f083e79fb4c3d0a925691e732c56911b4326 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Signed-off-by: Avijit Kanti Das <[email protected]>
ony · May 8, 2015 · 901de8c · 901de8c
1 parent 8dd4261
commit 901de8c
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
@@ -153,6 +153,7 @@ void ping_unhash(struct sock *sk)
 	if (sk_hashed(sk)) {
 		write_lock_bh(&ping_table.lock);
 		hlist_nulls_del(&sk->sk_nulls_node);
+		sk_nulls_node_init(&sk->sk_nulls_node);
 		sock_put(sk);
 		isk->inet_num = 0;
 		isk->inet_sport = 0;