]> git.baikalelectronics.ru Git - kernel.git/commit
rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
authorDavid Howells <dhowells@redhat.com>
Thu, 30 Jan 2020 21:50:36 +0000 (21:50 +0000)
committerDavid Howells <dhowells@redhat.com>
Mon, 3 Feb 2020 10:25:30 +0000 (10:25 +0000)
commitd2fe3f4fdb25417eb154610a66f6848bfc3bd841
tree0944eefed2d209e9bd7ccbdebebedf367757f61a
parent870a07a8f038d4a87b5720ea69a478e535d2ccb0
rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect

When a call is disconnected, the connection pointer from the call is
cleared to make sure it isn't used again and to prevent further attempted
transmission for the call.  Unfortunately, there might be a daemon trying
to use it at the same time to transmit a packet.

Fix this by keeping call->conn set, but setting a flag on the call to
indicate disconnection instead.

Remove also the bits in the transmission functions where the conn pointer is
checked and a ref taken under spinlock as this is now redundant.

Fixes: 5ff602858d22 ("rxrpc: Calls shouldn't hold socket refs")
Signed-off-by: David Howells <dhowells@redhat.com>
net/rxrpc/ar-internal.h
net/rxrpc/call_object.c
net/rxrpc/conn_client.c
net/rxrpc/conn_object.c
net/rxrpc/output.c