From 6114f469d2c59f00d97356490d4bcadbff98bf48 Mon Sep 17 00:00:00 2001 From: Bogdan Date: Wed, 19 Aug 2026 21:39:39 +0300 Subject: [PATCH] net/local: fix SCM_RIGHTS pointer and memory corruption Fix NULL pointer dereference and memory corruption by using file_put() instead of file_close() + kmm_free(). Add peer NULL check to local_freectl(). Signed-off-by: Bogdan --- net/local/local_conn.c | 3 +-- net/local/local_recvmsg.c | 2 +- net/local/local_sendmsg.c | 5 +++++ 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/net/local/local_conn.c b/net/local/local_conn.c index daaddfc62f84d..df9674f31f711 100644 --- a/net/local/local_conn.c +++ b/net/local/local_conn.c @@ -338,8 +338,7 @@ void local_free(FAR struct local_conn_s *conn) { if (conn->lc_cfps[i]) { - file_close(conn->lc_cfps[i]); - kmm_free(conn->lc_cfps[i]); + file_put(conn->lc_cfps[i]); conn->lc_cfps[i] = NULL; } } diff --git a/net/local/local_recvmsg.c b/net/local/local_recvmsg.c index 2197e4bb75688..ce8abadd86c0f 100644 --- a/net/local/local_recvmsg.c +++ b/net/local/local_recvmsg.c @@ -191,7 +191,7 @@ static void local_recvctl(FAR struct local_conn_s *conn, { if (peer->lc_cfpcount) { - memmove(peer->lc_cfps[0], peer->lc_cfps[i], + memmove(&peer->lc_cfps[0], &peer->lc_cfps[i], sizeof(FAR void *) * peer->lc_cfpcount); } } diff --git a/net/local/local_sendmsg.c b/net/local/local_sendmsg.c index 0bf31e7a823f6..33c488377f30d 100644 --- a/net/local/local_sendmsg.c +++ b/net/local/local_sendmsg.c @@ -63,6 +63,11 @@ static void local_freectl(FAR struct local_conn_s *conn, int count) { FAR struct local_conn_s *peer = conn->lc_peer; + if (peer == NULL) + { + peer = conn; + } + while (count-- > 0) { file_put(peer->lc_cfps[--peer->lc_cfpcount]);