| Message ID | 20200624100054.7168-1-dereksu@qnap.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v1] chardev/char-socket: fix double free of err after socket is disconnected | expand |
On 6/24/20 12:00 PM, Derek Su wrote: > The err is freed in check_report_connect_error() conditionally, > calling error_free() directly may lead to a double-free bug. This seems the same issue Lichun is working on, right? https://www.mail-archive.com/qemu-devel@nongnu.org/msg714709.html > > Signed-off-by: Derek Su <dereksu@qnap.com> > --- > chardev/char-socket.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/chardev/char-socket.c b/chardev/char-socket.c > index afebeec5c3..a009bed5ee 100644 > --- a/chardev/char-socket.c > +++ b/chardev/char-socket.c > @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque) > if (qio_task_propagate_error(task, &err)) { > tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED); > check_report_connect_error(chr, err); > - error_free(err); > + > + if (!s->connect_err_reported) { > + error_free(err); > + } > + > goto cleanup; > } > >
Oops! Sorry, I dont’t notice this patch before. Thanks. Derek Philippe Mathieu-Daudé <philmd@redhat.com>於 2020年6月24日 週三，下午6:12寫道： > On 6/24/20 12:00 PM, Derek Su wrote: > > The err is freed in check_report_connect_error() conditionally, > > calling error_free() directly may lead to a double-free bug. > > This seems the same issue Lichun is working on, right? > https://www.mail-archive.com/qemu-devel@nongnu.org/msg714709.html > > > > > Signed-off-by: Derek Su <dereksu@qnap.com> > > --- > > chardev/char-socket.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/chardev/char-socket.c b/chardev/char-socket.c > > index afebeec5c3..a009bed5ee 100644 > > --- a/chardev/char-socket.c > > +++ b/chardev/char-socket.c > > @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask > *task, void *opaque) > > if (qio_task_propagate_error(task, &err)) { > > tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED); > > check_report_connect_error(chr, err); > > - error_free(err); > > + > > + if (!s->connect_err_reported) { > > + error_free(err); > > + } > > + > > goto cleanup; > > } > > > > > > -- Best regards, Derek Su QNAP Systems, Inc. Email: dereksu@qnap.com Tel: (+886)-2-2393-5152 ext. 15017 Address: 13F., No.56, Sec. 1, Xinsheng S. Rd., Zhongzheng Dist., Taipei City, Taiwan
diff --git a/chardev/char-socket.c b/chardev/char-socket.c index afebeec5c3..a009bed5ee 100644 --- a/chardev/char-socket.c +++ b/chardev/char-socket.c @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque) if (qio_task_propagate_error(task, &err)) { tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED); check_report_connect_error(chr, err); - error_free(err); + + if (!s->connect_err_reported) { + error_free(err); + } + goto cleanup; }
The err is freed in check_report_connect_error() conditionally, calling error_free() directly may lead to a double-free bug. Signed-off-by: Derek Su <dereksu@qnap.com> --- chardev/char-socket.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)