socket buffer can get freed as part of sock_close callback so before adding reference check underneath socket validity.
Reported-by: [email protected] Signed-off-by: Santosh Shilimkar <[email protected]> --- net/rds/bind.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rds/bind.c b/net/rds/bind.c index 75d43dc..8dec06e 100644 --- a/net/rds/bind.c +++ b/net/rds/bind.c @@ -61,7 +61,7 @@ struct rds_sock *rds_find_bound(__be32 addr, __be16 port) struct rds_sock *rs; rs = rhashtable_lookup_fast(&bind_hash_table, &key, ht_parms); - if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) + if (rs && rds_rs_to_sk(rs) && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) rds_sock_addref(rs); else rs = NULL; -- 1.9.1
