The branch stable/12 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d
commit 3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d Author: Lv Yunlong <[email protected]> AuthorDate: 2021-05-18 19:23:15 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2021-05-25 13:28:54 +0000 socket: Release cred reference later in sodealloc() We dereference so->so_cred to update the per-uid socket buffer accounting, so the crfree() call must be deferred until after that point. PR: 255869 (cherry picked from commit b295c5ddcef4744ef7044d2327b4258b6ad055f0) --- sys/kern/uipc_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index ab05da880e46..dd028c660d2b 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -467,7 +467,6 @@ sodealloc(struct socket *so) #endif hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE); - crfree(so->so_cred); khelp_destroy_osd(&so->osd); if (SOLISTENING(so)) { if (so->sol_accept_filter != NULL) @@ -484,6 +483,7 @@ sodealloc(struct socket *so) SOCKBUF_LOCK_DESTROY(&so->so_snd); SOCKBUF_LOCK_DESTROY(&so->so_rcv); } + crfree(so->so_cred); mtx_destroy(&so->so_lock); uma_zfree(socket_zone, so); } _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all To unsubscribe, send any mail to "[email protected]"
