SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sd-netlink: fix use-after-free

Browse Source 
When a slot is disconnected, previously we tried to remove the slot from
the hashmap with a wrong key. Hence, the pointer to the freed slot object
remained in the hashmap.
This commit is contained in:
Yu Watanabe
2026-06-11 09:44:55 +02:00
committed by Daan De Meyer
parent 36562b721e
commit 6fb1698e3b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-netlink/netlink-slot.c
+1 -1
View File
@@ -61,7 +61,7 @@ void netlink_slot_disconnect(sd_netlink_slot *slot, bool unref) {
switch (slot->type) {
case NETLINK_REPLY_CALLBACK:
(void) hashmap_remove(nl->reply_callbacks, &slot->reply_callback.serial);
(void) hashmap_remove(nl->reply_callbacks, UINT32_TO_PTR(slot->reply_callback.serial));
if (slot->reply_callback.timeout != USEC_INFINITY)
prioq_remove(nl->reply_callbacks_prioq, &slot->reply_callback, &slot->reply_callback.prioq_idx);