slirp: Fix access to freed memoryv2.8.1.1v2.8.1v2.8.0-rc4v2.8.0-rc3v2.8.0-rc2v2.8.0-rc1v2.8.0-rc0v2.8.0

if_start() goes through the slirp->if_fastq and slirp->if_batchq
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
elements if ifm->ifq_so != NULL.  When freeing a socket, we thus need
to make sure that any pending message for this socket does not refer
to the socket any more.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Brian Candler <b.candler@pobox.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

1 files changed, 15 insertions, 0 deletions

diff --git a/socket.c b/socket.c
index bc9af2f..f6319ca 100644
--- a/socket.c
+++ b/socket.c
@@ -65,6 +65,21 @@ struct socket *socreate(Slirp *slirp)
 void sofree(struct socket *so)
 {
     Slirp *slirp = so->slirp;
+    struct mbuf *ifm;
+
+    for (ifm = (struct mbuf *)slirp->if_fastq.qh_link;
+         (struct quehead *)ifm != &slirp->if_fastq; ifm = ifm->ifq_next) {
+        if (ifm->ifq_so == so) {
+            ifm->ifq_so = NULL;
+        }
+    }
+
+    for (ifm = (struct mbuf *)slirp->if_batchq.qh_link;
+         (struct quehead *)ifm != &slirp->if_batchq; ifm = ifm->ifq_next) {
+        if (ifm->ifq_so == so) {
+            ifm->ifq_so = NULL;
+        }
+    }
 
     if (so->so_emu == EMU_RSH && so->extra) {
         sofree(so->extra);