diff options
| author | David Howells <dhowells@redhat.com> | 2020-01-31 00:50:35 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-11 15:35:05 +0300 |
| commit | 62221a9b1c9aef316ffa493340583827c045c2c0 (patch) | |
| tree | af409a49424af33be9f464390f6a5f4577e22ac7 /net | |
| parent | 5fa06c9568214537c42b32c9ec23ae0c70a4f8b7 (diff) | |
| download | linux-62221a9b1c9aef316ffa493340583827c045c2c0.tar.xz | |
rxrpc: Fix use-after-free in rxrpc_put_local()
[ Upstream commit fac20b9e738523fc884ee3ea5be360a321cd8bad ]
Fix rxrpc_put_local() to not access local->debug_id after calling
atomic_dec_return() as, unless that returned n==0, we no longer have the
right to access the object.
Fixes: 06d9532fa6b3 ("rxrpc: Fix read-after-free in rxrpc_queue_local()")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/rxrpc/local_object.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c index 36587260cabd..3aa179efcda4 100644 --- a/net/rxrpc/local_object.c +++ b/net/rxrpc/local_object.c @@ -364,11 +364,14 @@ void rxrpc_queue_local(struct rxrpc_local *local) void rxrpc_put_local(struct rxrpc_local *local) { const void *here = __builtin_return_address(0); + unsigned int debug_id; int n; if (local) { + debug_id = local->debug_id; + n = atomic_dec_return(&local->usage); - trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here); + trace_rxrpc_local(debug_id, rxrpc_local_put, n, here); if (n == 0) call_rcu(&local->rcu, rxrpc_local_rcu); |