]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7e23f79) | patch
rxrpc: Fix use-after-free in rxrpc_put_local()
authorDavid Howells <dhowells@redhat.com>
Thu, 30 Jan 2020 21:50:35 +0000 (21:50 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Feb 2020 12:33:54 +0000 (04:33 -0800)
commit85c45a480561e0dfc95d9707db2d71dfceac47bc
tree3366c40697394820d704790466ad530cd8cec5fdtree | snapshot
parent7e23f798afdc70774fb5447d9db364da558eb457commit | diff
rxrpc: Fix use-after-free in rxrpc_put_local()

[ Upstream commit fac20b9e738523fc884ee3ea5be360a321cd8bad ]

Fix rxrpc_put_local() to not access local->debug_id after calling
atomic_dec_return() as, unless that returned n==0, we no longer have the
right to access the object.

Fixes: 06d9532fa6b3 ("rxrpc: Fix read-after-free in rxrpc_queue_local()")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/rxrpc/local_object.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git