From b4196326c2a01cf4fee2088aa9d2e3a789db1750 Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Wed, 11 Mar 2026 17:21:05 -0400 Subject: [PATCH] MT#55283 fix stream close race condition Using the stream object after dropping the reference is unsafe. Change-Id: I58df474272cc7e168d6d65e5f6ace3a42fe22ef1 (cherry picked from commit 9a3f33a7030473679b8ee73ce86a7860c409e88c) (cherry picked from commit 4e8b3c8b9b924dd5f633d6bbafe61b5776f78b81) --- kernel-module/xt_RTPENGINE.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index 5142d3dff..f4689cbf6 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -1087,12 +1087,12 @@ static void stream_put(struct re_stream *stream) { if (!stream) return; - if (!atomic_dec_and_test(&stream->refcnt)) { - /* if this is an open file being closed and there's a del_stream() - * waiting for us, we need to wake up the sleeping del_stream() */ - wake_up_interruptible(&stream->close_wq); + /* if this is an open file being closed and there's a del_stream() + * waiting for us, we need to wake up the sleeping del_stream() */ + wake_up_interruptible(&stream->close_wq); + + if (!atomic_dec_and_test(&stream->refcnt)) return; - } DBG("Freeing stream object\n");