Module: xenomai-gch
Branch: for-forge
Commit: bdc78af9b1c249c4567aa1db1bc0e621dbcdea50
URL:
http://git.xenomai.org/?p=xenomai-gch.git;a=commit;h=bdc78af9b1c249c4567aa1db1bc0e621dbcdea50
Author: Gilles Chanteperdrix <gilles.chanteperd...@xenomai.org>
Date: Tue Sep 29 23:09:31 2015 +0200
rtnet/icmp: reference socket in icmp_dest_socket()
Otherwise when rt_ip_rcv() dereferences the socket, its fake reference
count reaches 0, which causes a destruction of the nonexistent file
descriptor associated with this fake icmp socket. Ending up with a
kernel oops in fd_cleanup_thread().
---
kernel/drivers/net/stack/ipv4/icmp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/drivers/net/stack/ipv4/icmp.c
b/kernel/drivers/net/stack/ipv4/icmp.c
index 4b83942..b6ae736 100644
--- a/kernel/drivers/net/stack/ipv4/icmp.c
+++ b/kernel/drivers/net/stack/ipv4/icmp.c
@@ -446,8 +446,7 @@ static struct rt_icmp_control
rt_icmp_pointers[NR_ICMP_TYPES+1] =
*/
struct rtsocket *rt_icmp_dest_socket(struct rtskb *skb)
{
- /* Note that the socket's refcount is not used by this protocol.
- * The socket returned here is static and not part of the global pool. */
+ rt_socket_reference(icmp_socket);
return icmp_socket;
}
_______________________________________________
Xenomai-git mailing list
Xenomai-git@xenomai.org
http://xenomai.org/mailman/listinfo/xenomai-git
