nuttx/nuttx-mirror
1
2
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2025-01-13 06:18:40 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

local_sock: fix accept use-after-free

Browse source 
we should get next waiter before acceptor released

Signed-off-by: fangzhenwei <fangzhenwei@xiaomi.com>
This commit is contained in:
fangzhenwei 2024-06-07 11:51:15 +08:00 committed by Xiang Xiao
parent 5c3025e2fb
commit a6f8730c51
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
include/nuttx/queue.h
View file

@ -172,6 +172,9 @@
for((p) = (q)->head, (tmp) = (p) ? (p)->flink : NULL; \
(p) != NULL; (p) = (tmp), (tmp) = (p) ? (p)->flink : NULL)
#define dq_for_every(q, p) sq_for_every(q, p)
#define dq_for_every_safe(q, p, tmp) sq_for_every_safe(q, p, tmp)
#define sq_rem(p, q) \
do \
{ \

5
net/local/local_release.c
View file

@ -73,14 +73,13 @@ int local_release(FAR struct local_conn_s *conn)
{
FAR struct local_conn_s *accept;
FAR dq_entry_t *waiter;
FAR dq_entry_t *tmp;
DEBUGASSERT(conn->lc_proto == SOCK_STREAM);
/* Are there still clients waiting for a connection to the server? */
for (waiter = dq_peek(&conn->u.server.lc_waiters);
waiter != NULL;
waiter = dq_next(&accept->u.accept.lc_waiter))
dq_for_every_safe(&conn->u.server.lc_waiters, waiter, tmp)
{
accept = container_of(waiter, struct local_conn_s,
u.accept.lc_waiter);