Re: Use-after-free in ppoll

Rainer Weikusat
2015-11-22T18:52:07Z

Rainer Weikusat <rweikusat@mobileactivedefense.com> writes:

[...]

> because of the close, this routine will be called with the peer_wait
> wait_queue_head of the non-closed socket of the socket pair as
> wait_address argument.

This should have been "peer_wait wait_queue_head of the peer of the
non-closed socket, ie, that of the closed socket"...