diff options
| author | Lv Yunlong <lylgood@foxmail.com> | 2021-05-18 19:23:15 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-05-18 19:25:40 +0000 |
| commit | b295c5ddcef4744ef7044d2327b4258b6ad055f0 (patch) | |
| tree | 68322635d217eccc8190b33437fd64ffedc6d68e | |
| parent | c4a6258d70f73c27d8f0c6233edbcc609791806b (diff) | |
socket: Release cred reference later in sodealloc()
We dereference so->so_cred to update the per-uid socket buffer
accounting, so the crfree() call must be deferred until after that
point.
PR: 255869
MFC after: 1 week
| -rw-r--r-- | sys/kern/uipc_socket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index ea86f66556ea..2a167eb68a22 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -476,7 +476,6 @@ sodealloc(struct socket *so) #endif hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE); - crfree(so->so_cred); khelp_destroy_osd(&so->osd); if (SOLISTENING(so)) { if (so->sol_accept_filter != NULL) @@ -493,6 +492,7 @@ sodealloc(struct socket *so) SOCKBUF_LOCK_DESTROY(&so->so_snd); SOCKBUF_LOCK_DESTROY(&so->so_rcv); } + crfree(so->so_cred); mtx_destroy(&so->so_lock); uma_zfree(socket_zone, so); } |