diff options
author | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2016-11-13 23:54:27 +0100 |
---|---|---|
committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2016-11-14 17:36:33 +0100 |
commit | e1619211e9af886fad074a7826064d09c40a5e94 (patch) | |
tree | 1577bcecfe92e840f6152db3bc313f5d8f102cae /socket.c | |
parent | 84692fe597767aaac192f10985834523371f35b8 (diff) | |
download | slirp-2.8.0-rc3.zip slirp-2.8.0-rc3.tar.gz slirp-2.8.0-rc3.tar.bz2 |
slirp: Fix access to freed memoryv2.8.1.1v2.8.1v2.8.0-rc4v2.8.0-rc3v2.8.0-rc2v2.8.0-rc1v2.8.0-rc0v2.8.0
if_start() goes through the slirp->if_fastq and slirp->if_batchq
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
elements if ifm->ifq_so != NULL. When freeing a socket, we thus need
to make sure that any pending message for this socket does not refer
to the socket any more.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Brian Candler <b.candler@pobox.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'socket.c')
-rw-r--r-- | socket.c | 15 |
1 files changed, 15 insertions, 0 deletions
@@ -65,6 +65,21 @@ struct socket *socreate(Slirp *slirp) void sofree(struct socket *so) { Slirp *slirp = so->slirp; + struct mbuf *ifm; + + for (ifm = (struct mbuf *)slirp->if_fastq.qh_link; + (struct quehead *)ifm != &slirp->if_fastq; ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } + + for (ifm = (struct mbuf *)slirp->if_batchq.qh_link; + (struct quehead *)ifm != &slirp->if_batchq; ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } if (so->so_emu == EMU_RSH && so->extra) { sofree(so->extra); |