[Query] regarding sock_ioctl in linux kernel

[Satinder]

Hi everybody,

I was viewing the linux source code (version 2.6.9 )
for socket APIs.

in function sock_ioctl() [file net/socket.c.]
I found that the kernel is handling the socket pointer
without any check.
Even in 'default' case it is calling
sock->ops->ioctl() without checking whether the
sock->ops having value or not.

Is this assumed that the kernel will call the
sock_ioctl only when the socket data structure/ file
structure/socket substructure exists, or there is
some other reason for not putting checks before
calling file operations in sock_ioctl

There may be case when someone may alloc socket in
init module and map it to file descriptor using
sock_map_fd() and increament its reference count using
fget().

And at cleanup time it releases the socket using
sock_release() without unmaping file descriptor and
decreamenting the referenece count.

and socket->file would be NULL without freeing the
inode number when sock_release returns. So at reboot
time many network process may try to use this socket
beacause inode is not being released. In this case
kernel may crash.?

If anyone could explain this that would be very nice.
Please keep me in cc.
TIA

Regards,
Satinder

Send instant messages to your online friends http://in.messenger.yahoo.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Ram Gupta]

It seems that whenever socket is allocated it is also mapped with its
operations also as it calls sock_map_fd after sock_alloc or assigns
the sock->ops when duplicating it. Currently does not look like there
is need for the check but may be better to check to make sure there is
no ommission in new type of socket allocations in future.

regards
Ram Gupta