mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 23:36:23 +09:00
rxrpc: Fix use-after-free in rxrpc_put_local()
[ Upstream commit fac20b9e738523fc884ee3ea5be360a321cd8bad ]
Fix rxrpc_put_local() to not access local->debug_id after calling
atomic_dec_return() as, unless that returned n==0, we no longer have the
right to access the object.
Fixes: 06d9532fa6
("rxrpc: Fix read-after-free in rxrpc_queue_local()")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5fa06c9568
commit
62221a9b1c
|
@ -364,11 +364,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
|
|||
void rxrpc_put_local(struct rxrpc_local *local)
|
||||
{
|
||||
const void *here = __builtin_return_address(0);
|
||||
unsigned int debug_id;
|
||||
int n;
|
||||
|
||||
if (local) {
|
||||
debug_id = local->debug_id;
|
||||
|
||||
n = atomic_dec_return(&local->usage);
|
||||
trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
|
||||
trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);
|
||||
|
||||
if (n == 0)
|
||||
call_rcu(&local->rcu, rxrpc_local_rcu);
|
||||
|
|
Loading…
Reference in New Issue
Block a user