rxrpc: Fix use-after-free in rxrpc_put_local()

[ Upstream commit fac20b9e738523fc884ee3ea5be360a321cd8bad ]

Fix rxrpc_put_local() to not access local->debug_id after calling
atomic_dec_return() as, unless that returned n==0, we no longer have the
right to access the object.

Fixes: 06d9532fa6b3 ("rxrpc: Fix read-after-free in rxrpc_queue_local()")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 04f0976..4fe9221 100644 (file)
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -368,11 +368,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
 void rxrpc_put_local(struct rxrpc_local *local)
 {
        const void *here = __builtin_return_address(0);
+       unsigned int debug_id;
        int n;
 
        if (local) {
+               debug_id = local->debug_id;
+
                n = atomic_dec_return(&local->usage);
-               trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
+               trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);
 
                if (n == 0)
                        call_rcu(&local->rcu, rxrpc_local_rcu);