1 files changed, 8 insertions, 5 deletions

diff --git a/net/socket.c b/net/socket.c
index dbd1a6851edd..3145103cdf54 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1145,8 +1145,11 @@ static int __sock_create(int family, int type, int protocol, struct socket **res
         if (!try_module_get(net_families[family]->owner))
                 goto out_release;
 
-        if ((err = net_families[family]->create(sock, protocol)) < 0)
+        if ((err = net_families[family]->create(sock, protocol)) < 0) {
+                sock->ops = NULL;
                 goto out_module_put;
+        }
+
         /*
          * Now to bump the refcnt of the [loadable] module that owns this
          * socket at sock_release time we decrement its refcnt.
@@ -1360,16 +1363,16 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, int _
         newsock->type = sock->type;
         newsock->ops = sock->ops;
 
-        err = security_socket_accept(sock, newsock);
-        if (err)
-                goto out_release;
-
         /*
          * We don't need try_module_get here, as the listening socket (sock)
          * has the protocol module (sock->ops->owner) held.
          */
         __module_get(newsock->ops->owner);
 
+        err = security_socket_accept(sock, newsock);
+        if (err)
+                goto out_release;
+
         err = sock->ops->accept(sock, newsock, sock->file->f_flags);
         if (err < 0)
                 goto out_release;