From e1619211e9af886fad074a7826064d09c40a5e94 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Sun, 13 Nov 2016 23:54:27 +0100 Subject: slirp: Fix access to freed memory if_start() goes through the slirp->if_fastq and slirp->if_batchq list of pending messages, and accesses ifm->ifq_so->so_nqueued of its elements if ifm->ifq_so != NULL. When freeing a socket, we thus need to make sure that any pending message for this socket does not refer to the socket any more. Signed-off-by: Samuel Thibault Tested-by: Brian Candler Reviewed-by: Stefan Hajnoczi --- socket.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/socket.c b/socket.c index bc9af2f..f6319ca 100644 --- a/socket.c +++ b/socket.c @@ -65,6 +65,21 @@ struct socket *socreate(Slirp *slirp) void sofree(struct socket *so) { Slirp *slirp = so->slirp; + struct mbuf *ifm; + + for (ifm = (struct mbuf *)slirp->if_fastq.qh_link; + (struct quehead *)ifm != &slirp->if_fastq; ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } + + for (ifm = (struct mbuf *)slirp->if_batchq.qh_link; + (struct quehead *)ifm != &slirp->if_batchq; ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } if (so->so_emu == EMU_RSH && so->extra) { sofree(so->extra); -- cgit v1.1