sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

local_sock: fix accept use-after-free

Browse Source 
we should get next waiter before acceptor released

Signed-off-by: fangzhenwei <fangzhenwei@xiaomi.com>
This commit is contained in:
fangzhenwei 2024-06-07 11:51:15 +08:00 committed by Xiang Xiao
parent a8ffa96b65
commit cc9d42804b
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/nuttx/queue.h
View File

@ -170,6 +170,9 @@
for((p) = (q)->head, (tmp) = (p) ? (p)->flink : NULL; \
(p) != NULL; (p) = (tmp), (tmp) = (p) ? (p)->flink : NULL)
#define dq_for_every(q, p) sq_for_every(q, p)
#define dq_for_every_safe(q, p, tmp) sq_for_every_safe(q, p, tmp)
#define sq_rem(p, q) \
do \
{ \

5
net/local/local_release.c
View File

@ -73,14 +73,13 @@ int local_release(FAR struct local_conn_s *conn)
{
FAR struct local_conn_s *accept;
FAR dq_entry_t *waiter;
FAR dq_entry_t *tmp;
DEBUGASSERT(conn->lc_proto == SOCK_STREAM);
/* Are there still clients waiting for a connection to the server? */
for (waiter = dq_peek(&conn->u.server.lc_waiters);
waiter != NULL;
waiter = dq_next(&accept->u.accept.lc_waiter))
dq_for_every_safe(&conn->u.server.lc_waiters, waiter, tmp)
{
accept = container_of(waiter, struct local_conn_s,
u.accept.lc_waiter);