vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

slirp: Fix access to freed memory 

if_start() goes through the slirp->if_fastq and slirp->if_batchq
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
elements if ifm->ifq_so != NULL.  When freeing a socket, we thus need
to make sure that any pending message for this socket does not refer
to the socket any more.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Brian Candler <b.candler@pobox.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit ea64d5f088)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Samuel Thibault 2016-11-13 23:54:27 +01:00 committed by Michael Roth
parent 92230a5963
commit e9dbd28e2a
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
slirp/socket.c
View File

@ -66,6 +66,23 @@ void
sofree(struct socket *so)
{
Slirp *slirp = so->slirp;
struct mbuf *ifm;
for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
(struct quehead *) ifm != &slirp->if_fastq;
ifm = ifm->ifq_next) {
if (ifm->ifq_so == so) {
ifm->ifq_so = NULL;
}
}
for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
(struct quehead *) ifm != &slirp->if_batchq;
ifm = ifm->ifq_next) {
if (ifm->ifq_so == so) {
ifm->ifq_so = NULL;
}
}
if (so->so_emu==EMU_RSH && so->extra) {
sofree(so->extra);