dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-02 22:20:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

network: fix use-after-free in {address,route}_remove_and_cancel()

Browse Source 
Fixes #31485.
This commit is contained in:
Yu Watanabe
2024-02-26 12:09:52 +09:00
committed by Luca Boccassi
parent 52672db3f8
commit 7036d472d0
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/network/networkd-address.c
View File

@@ -1180,8 +1180,8 @@ int address_remove(Address *address, Link *link) {
}
int address_remove_and_cancel(Address *address, Link *link) {
_cleanup_(request_unrefp) Request *req = NULL;
bool waiting = false;
Request *req;
assert(address);
assert(link);
@@ -1193,6 +1193,7 @@ int address_remove_and_cancel(Address *address, Link *link) {
/* Cancel the request for the address. If the request is already called but we have not received the
* notification about the request, then explicitly remove the address. */
if (address_get_request(link, address, &req) >= 0) {
request_ref(req); /* avoid the request freed by request_detach() */
waiting = req->waiting_reply;
request_detach(req);
address_cancel_requesting(address);

3
src/network/networkd-route.c
View File

@@ -600,8 +600,8 @@ int route_remove(Route *route, Manager *manager) {
}
int route_remove_and_cancel(Route *route, Manager *manager) {
_cleanup_(request_unrefp) Request *req = NULL;
bool waiting = false;
Request *req;
assert(route);
assert(manager);
@@ -612,6 +612,7 @@ int route_remove_and_cancel(Route *route, Manager *manager) {
/* Cancel the request for the route. If the request is already called but we have not received the
* notification about the request, then explicitly remove the route. */
if (route_get_request(manager, route, &req) >= 0) {
request_ref(req); /* avoid the request freed by request_detach() */
waiting = req->waiting_reply;
request_detach(req);
route_cancel_requesting(route);