• David Howells's avatar
    rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect · 5273a191
    David Howells authored
    When a call is disconnected, the connection pointer from the call is
    cleared to make sure it isn't used again and to prevent further attempted
    transmission for the call.  Unfortunately, there might be a daemon trying
    to use it at the same time to transmit a packet.
    
    Fix this by keeping call->conn set, but setting a flag on the call to
    indicate disconnection instead.
    
    Remove also the bits in the transmission functions where the conn pointer is
    checked and a ref taken under spinlock as this is now redundant.
    
    Fixes: 8d94aa38 ("rxrpc: Calls shouldn't hold socket refs")
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    5273a191
conn_object.c 12.6 KB