rxrpc: Fix use-after-free in rxrpc_put_local() (fac20b9e) · Commits · 戴 / test

Fix rxrpc_put_local() to not access local->debug_id after calling atomic_dec_return() as, unless that returned n==0, we no longer have the right to access the object. Fixes: ("rxrpc: Fix read-after-free in rxrpc_queue_local()") Signed-off-by:

David Howells <dhowells@redhat.com>

net/rxrpc/local_object.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -364,11 +364,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
		void rxrpc_put_local(struct rxrpc_local *local)
		{
		const void *here = __builtin_return_address(0);
		unsigned int debug_id;
		int n;

		if (local) {
		debug_id = local->debug_id;

		n = atomic_dec_return(&local->usage);
		trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
		trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);

		if (n == 0)
		call_rcu(&local->rcu, rxrpc_local_rcu);

Admin message