Commit 98cd3c77 authored Dec 04, 2019 by Deepak Kumar Singh

net: qrtr: free flow structure after radix tree node delete

Freeing flow structure before deleting respective node from radix
tree can result in use after free in radix tree node delete function.

Now freeing flow structure after node is deleted from radix tree.

Change-Id: I3dcf374deb9c806da74cdd8d96f715224a62c36c
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>

parent 12c0afc9

net/qrtr/qrtr.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -346,8 +346,8 @@ static void __qrtr_node_release(struct kref *kref)
		sock_put(waiter->sk);
		kfree(waiter);
		}
		kfree(flow);
		radix_tree_delete(&node->qrtr_tx_flow, iter.index);
		kfree(flow);
		}
		mutex_unlock(&node->qrtr_tx_lock);