提交 3d09fc42 编写于 作者: J Jon Paul Maloy 提交者: David S. Miller

tipc: eliminate case of writing to freed memory

In the function tipc_nodesub_notify() we call a function pointer
aggregated into the object to be notified, whereafter we set
the function pointer to NULL. However, in some cases the function
pointed to will free the struct containing the function pointer,
resulting in a write to already freed memory.

This bug seems to always have been there, without causing any
notable harm.

In this commit we fix the problem by inverting the order of the
zeroing and the function call.
Signed-off-by: NJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 f5b26503
...@@ -84,11 +84,13 @@ void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub) ...@@ -84,11 +84,13 @@ void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub)
void tipc_nodesub_notify(struct list_head *nsub_list) void tipc_nodesub_notify(struct list_head *nsub_list)
{ {
struct tipc_node_subscr *ns, *safe; struct tipc_node_subscr *ns, *safe;
net_ev_handler handle_node_down;
list_for_each_entry_safe(ns, safe, nsub_list, nodesub_list) { list_for_each_entry_safe(ns, safe, nsub_list, nodesub_list) {
if (ns->handle_node_down) { handle_node_down = ns->handle_node_down;
ns->handle_node_down(ns->usr_handle); if (handle_node_down) {
ns->handle_node_down = NULL; ns->handle_node_down = NULL;
handle_node_down(ns->usr_handle);
} }
} }
} }
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册