Pau Espin 2b11e9e97d trxcon: Fix heap-use-after-free in l1ctl_client ... If the peer connected to trxcon restarts the process, read() on the unix socket in trxcon fails, and triggers closing the conn (l1ctl_client), which ends up freeing the struct. This all happens during read_cb() of the l1ctl_client wqueue. If the kernel also flags WRITE event in the same main loop iteration, the wqueue code would end up using the freed struct again when running the write_cb. Make sure the read_cb returns -EBADF in the code branch closing the conn in read_cb, since it makes no sense to handle a write_cb after that. This saves the code from accessing the potentially freed struct. Related: OS#5872 Change-Id: I100a8ba056a09b4e52675e3539640da0c0f8d837		2023-01-30 18:23:55 +01:00
..
include	trxcon: allow extending FBSB timeout (quirks for slow PHYs)	2022-12-20 23:28:56 +07:00
m4	trxcon: separate the scheduler into libl1sched.la	2022-07-12 19:29:13 +07:00
src	trxcon: Fix heap-use-after-free in l1ctl_client	2023-01-30 18:23:55 +01:00
.gitignore	trxcon: separate the scheduler into libl1sched.la	2022-07-12 19:29:13 +07:00
Makefile.am	trxcon: separate the scheduler into libl1sched.la	2022-07-12 19:29:13 +07:00
configure.ac	trxcon: configure.ac: call LT_INIT after setting CFLAGS	2022-11-10 16:10:10 +00:00