Possible use after release

Bug #1271109 reported by Shlomo Pongratz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Accelio
Confirmed
Medium
Eyal Salomon

Bug Description

In xio_conn.c, function xio_conn_close.

kref_put may call xio_conn_delayed_close which may free the conn, however conn is referenced later.

 kref_put(&conn->kref, xio_conn_delayed_close); <- can free.

 if (observer) {
  xio_conn_notify_observer(
    conn, observer,
    XIO_CONN_EVENT_CLOSED, NULL); <- possible use after free.

  xio_conn_unhash_observer(conn, observer);
  xio_conn_unreg_observer(conn, observer);
 }

Eyal Salomon (esalomon)
Changed in accelio:
importance: Undecided → Medium
assignee: nobody → Eyal Salomon (esalomon)
milestone: none → accipiter-1.0
Eyal Salomon (esalomon)
Changed in accelio:
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.