rxrpc: Fix a couple of potential use-after-frees
authorDavid Howells <dhowells@redhat.com>
Sat, 24 Dec 2022 14:49:00 +0000 (14:49 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 28 Dec 2022 09:59:23 +0000 (09:59 +0000)
commit0e50d999903c009b6a9cd2277c82d6798d982e31
tree2c8c72932a63fcd1c526699b15ec3ce9ae72c85a
parentd3805695fe1e7383517903715cefc9bbdcffdc90
rxrpc: Fix a couple of potential use-after-frees

At the end of rxrpc_recvmsg(), if a call is found, the call is put and then
a trace line is emitted referencing that call in a couple of places - but
the call may have been deallocated by the time those traces happen.

Fix this by stashing the call debug_id in a variable and passing that to
the tracepoint rather than the call pointer.

Fixes: 849979051cbc ("rxrpc: Add a tracepoint to follow what recvmsg does")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: David S. Miller <davem@davemloft.net>
include/trace/events/rxrpc.h
net/rxrpc/recvmsg.c