Skip to content

Commit

Permalink
rxrpc: Fix use-after-free in rxrpc_put_local()
Browse files Browse the repository at this point in the history
Fix rxrpc_put_local() to not access local->debug_id after calling
atomic_dec_return() as, unless that returned n==0, we no longer have the
right to access the object.

Fixes: 06d9532 ("rxrpc: Fix read-after-free in rxrpc_queue_local()")
Signed-off-by: David Howells <dhowells@redhat.com>
  • Loading branch information
dhowells committed Jan 30, 2020
1 parent 9fbf082 commit fac20b9
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion net/rxrpc/local_object.c
Original file line number Diff line number Diff line change
Expand Up @@ -364,11 +364,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
void rxrpc_put_local(struct rxrpc_local *local)
{
const void *here = __builtin_return_address(0);
unsigned int debug_id;
int n;

if (local) {
debug_id = local->debug_id;

n = atomic_dec_return(&local->usage);
trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);

if (n == 0)
call_rcu(&local->rcu, rxrpc_local_rcu);
Expand Down

0 comments on commit fac20b9

Please sign in to comment.