Re: [PATCH] use-after-free while iterating session->conn_list (two places)

On Wed, 3 May 2017 16:35:45 +0000
Anton Kovalenko <[email protected]> wrote:

> The problem (accessing session->conn_list after freeing session) was discovered using valgrind.
> 
> Note that while list_for_each_entry_safe is safe against current list element destruction, 
> it is UNSAFE against the traversed list_head (third argument) becoming invalid during iteration.
> That's exactly what happens when the last connection of a session goes away (conn_exit -> session_put -> use-after-free).

Great catch, applied both. Any other places like this?

Thanks a lot!