• David Howells's avatar
    rxrpc: Fix read-after-free in rxrpc_queue_local() · 06d9532f
    David Howells authored
    rxrpc_queue_local() attempts to queue the local endpoint it is given and
    then, if successful, prints a trace line.  The trace line includes the
    current usage count - but we're not allowed to look at the local endpoint
    at this point as we passed our ref on it to the workqueue.
    
    Fix this by reading the usage count before queuing the work item.
    
    Also fix the reading of local->debug_id for trace lines, which must be done
    with the same consideration as reading the usage count.
    
    Fixes: 09d2bf59 ("rxrpc: Add a tracepoint to track rxrpc_local refcounting")
    Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    06d9532f
rxrpc.h 42.2 KB