This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 3d14dd86ddaabe9a56af9e6c5ef894d29697f42c Author: wangyongrong <[email protected]> AuthorDate: Fri May 29 17:21:56 2026 +0800 vsock: fix use-after-free in shutdown error path In vsock_close_internal, when vsock_send_pkt fails, vsock_sub_ref was called before vsock_unlock. If sub_ref drops the last reference, conn is freed and the subsequent vsock_unlock dereferences a freed pointer. Swap the order to unlock first, matching the normal exit path. Signed-off-by: wangyongrong <[email protected]> --- net/vsock/vsock_sockif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/vsock/vsock_sockif.c b/net/vsock/vsock_sockif.c index 64ba36c8fbd..0f19d577384 100644 --- a/net/vsock/vsock_sockif.c +++ b/net/vsock/vsock_sockif.c @@ -2175,8 +2175,8 @@ static int vsock_close(FAR struct socket *psock) if (ret < 0) { vsockdbg("send shutdown failed conn=%p\n", conn); - vsock_sub_ref(conn); vsock_unlock(conn); + vsock_sub_ref(conn); return ret; }
