From: Alan T. DeKok <aland@freeradius.org>
Date: Sat, 13 Dec 2025 21:13:14 +0000 (-0500)
Subject: treq may be NULL
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=726c729d61278d86bc2c91e0cd9a822bdaf99840;p=thirdparty%2Ffreeradius-server.git

treq may be NULL

if the retry timer hits before the worker thread decides that the
request is runnable again
---

diff --git a/src/modules/rlm_radius/bio.c b/src/modules/rlm_radius/bio.c
index 119c665f100..1cd5bf1ae41 100644
--- a/src/modules/rlm_radius/bio.c
+++ b/src/modules/rlm_radius/bio.c
@@ -1546,14 +1546,24 @@ static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t c
 
 static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
 {
-	trunk_request_t		*treq = talloc_get_type_abort(u->treq, trunk_request_t);
-	trunk_connection_t	*tconn = treq->tconn;
-	fr_time_t		now = retry->updated;
+	trunk_request_t		*treq;
+	trunk_connection_t	*tconn;
+	fr_time_t		now;
+
+	if (!u->treq) {
+		RDEBUG("Packet was cancelled by the connection handler - ignoring retry");
+		return;
+	}
+
+	treq = talloc_get_type_abort(u->treq, trunk_request_t);
 
 	fr_assert(request == treq->request);
 	fr_assert(treq->preq);						/* Must still have a protocol request */
 	fr_assert(treq->preq == u);
 
+	tconn = treq->tconn;
+	now = retry->updated;
+
 	switch (retry->state) {
 	case FR_RETRY_CONTINUE:
 		u->retry = *retry;