net: avoid NULL deref in inet_ctl_sock_destroy()

[ Upstream commit 8fa677d2706d325d71dab91bf6e6512c05214e37 ]

Under low memory conditions, tcp_sk_init() and icmp_sk_init()
can both iterate on all possible cpus and call inet_ctl_sock_destroy(),
with eventual NULL pointer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit f79c83d6c41930362bc66fc71489e92975a2facf)

Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index 18c773286b91744ccf0447b60597db3acc353f9a..1fb67ab46ad0bb4d1d836f4283b64376314cb69c 100644 (file)
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -47,7 +47,8 @@ extern int                    inet_ctl_sock_create(struct sock **sk,
 
 static inline void inet_ctl_sock_destroy(struct sock *sk)
 {
-       sk_release_kernel(sk);
+       if (sk)
+               sk_release_kernel(sk);
 }
 
 #endif