From b7669eea36750ae0d7395824bae8a70215aa4d2d Mon Sep 17 00:00:00 2001 From: evgeny Date: Fri, 11 Sep 2026 13:21:35 +0300 Subject: [PATCH] Fix use-after-free of ETCP_LINK in keepalive_timer_cb --- src/transport_layer/etcp_keepalive.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/transport_layer/etcp_keepalive.c b/src/transport_layer/etcp_keepalive.c index 511d5f4b..d7b5ab6d 100644 --- a/src/transport_layer/etcp_keepalive.c +++ b/src/transport_layer/etcp_keepalive.c @@ -122,7 +122,9 @@ static void keepalive_timer_cb(void* arg) { int old_link_status = link->link_status; link->link_status = 0; etcp_fire_link_status_cbk(link, link->link_state, old_link_status); - etcp_on_link_down(link->etcp, link); + struct ETCP_CONN *etcp = link->etcp; /* сохранить до каскада: etcp_on_link_down может закрыть conn и освободить link */ + etcp_on_link_down(etcp, link); + if (etcp->state == 2) return; /* conn+link освобождены каскадом, link трогать нельзя */ if (link->is_tcp && link->tcp_link) { stcp_link_close(link->tcp_link); link->tcp_link = NULL; } if (old_link_status) { DEBUG_INFO(DEBUG_CATEGORY_CONNECTION, "[%s] Link %d down: addr=%s ka=%d remote_ka=%d state=%d init=%d tmo: %llu>%llu els=%llums", link->etcp->log_name, link->local_link_id, sockaddr_storage_to_str(&link->remote_addr).str, link->recv_keepalive, link->remote_keepalive, link->link_state, link->initialized, (unsigned long long)timeout_units, (unsigned long long)elapsed, (unsigned long long)(elapsed/10));