Browse Source

etcp: сбрасывать last_rr_link при закрытии линка в обеих ветках (use-after-free в loadbalancer)

v2
evgeny 3 weeks ago
parent
commit
fdad786744
  1. 2
      src/transport_layer/etcp_connections.c

2
src/transport_layer/etcp_connections.c

@ -960,6 +960,7 @@ static void etcp_inflight_nullify_link(struct ll_queue* q, struct ETCP_LINK* dea
void etcp_link_close(struct ETCP_LINK* link) { void etcp_link_close(struct ETCP_LINK* link) {
DEBUG_TRACE(DEBUG_CATEGORY_CONNECTION, ""); DEBUG_TRACE(DEBUG_CATEGORY_CONNECTION, "");
if (!link) return; if (!link) return;
if (link->etcp && link->etcp->last_rr_link == link) link->etcp->last_rr_link = NULL;
if (link->is_tcp) { if (link->is_tcp) {
if (link->tcp_reconnect_timer) { uasync_cancel_timeout(link->etcp->instance->ua, link->tcp_reconnect_timer); link->tcp_reconnect_timer = NULL; } if (link->tcp_reconnect_timer) { uasync_cancel_timeout(link->etcp->instance->ua, link->tcp_reconnect_timer); link->tcp_reconnect_timer = NULL; }
@ -1013,7 +1014,6 @@ void etcp_link_close(struct ETCP_LINK* link) {
} }
pp = &(*pp)->next; pp = &(*pp)->next;
} }
if (link->etcp->last_rr_link == link) link->etcp->last_rr_link = NULL;
remove_link_from_queue(link); remove_link_from_queue(link);

Loading…
Cancel
Save