• Jon Paul Maloy's avatar
    tipc: eliminate case of writing to freed memory · 3d09fc42
    Jon Paul Maloy authored
    In the function tipc_nodesub_notify() we call a function pointer
    aggregated into the object to be notified, whereafter we set
    the function pointer to NULL. However, in some cases the function
    pointed to will free the struct containing the function pointer,
    resulting in a write to already freed memory.
    
    This bug seems to always have been there, without causing any
    notable harm.
    
    In this commit we fix the problem by inverting the order of the
    zeroing and the function call.
    Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    3d09fc42
node_subscr.c 3.25 KB