path: root/net
diff options
authorDavid Howells <dhowells@redhat.com>2020-01-30 21:50:35 +0000
committerDavid Howells <dhowells@redhat.com>2020-01-30 21:50:41 +0000
commitfac20b9e738523fc884ee3ea5be360a321cd8bad (patch)
treeae116a5a1ab3b27ee80d49fe7fea7134ebeaff94 /net
parent9fbf082f569980ddd7cab348e0a118678db0e47e (diff)
rxrpc: Fix use-after-free in rxrpc_put_local()
Fix rxrpc_put_local() to not access local->debug_id after calling atomic_dec_return() as, unless that returned n==0, we no longer have the right to access the object. Fixes: 06d9532fa6b3 ("rxrpc: Fix read-after-free in rxrpc_queue_local()") Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net')
1 files changed, 4 insertions, 1 deletions
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 36587260cabd..3aa179efcda4 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -364,11 +364,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
void rxrpc_put_local(struct rxrpc_local *local)
const void *here = __builtin_return_address(0);
+ unsigned int debug_id;
int n;
if (local) {
+ debug_id = local->debug_id;
n = atomic_dec_return(&local->usage);
- trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
+ trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);
if (n == 0)
call_rcu(&local->rcu, rxrpc_local_rcu);