|
 |
5d360b |
From 8c490d636f5dbe289b43cd0c34413aca3e62e2a9 Mon Sep 17 00:00:00 2001
|
|
|
5d360b |
From: Xiao Wang <jasowang@redhat.com>
|
|
|
5d360b |
Date: Mon, 27 Nov 2017 07:07:56 +0100
|
|
|
5d360b |
Subject: [PATCH 5/9] slirp: Fix access to freed memory
|
|
|
5d360b |
|
|
|
5d360b |
RH-Author: Xiao Wang <jasowang@redhat.com>
|
|
|
5d360b |
Message-id: <1511766477-29559-4-git-send-email-jasowang@redhat.com>
|
|
|
5d360b |
Patchwork-id: 77898
|
|
|
5d360b |
O-Subject: [RHEL7.5 qemu-kvm PATCH 3/4] slirp: Fix access to freed memory
|
|
|
5d360b |
Bugzilla: 1508745
|
|
|
5d360b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
5d360b |
RH-Acked-by: wexu@redhat.com
|
|
|
5d360b |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
5d360b |
|
|
|
5d360b |
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
|
5d360b |
|
|
|
5d360b |
if_start() goes through the slirp->if_fastq and slirp->if_batchq
|
|
|
5d360b |
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
|
|
|
5d360b |
elements if ifm->ifq_so != NULL. When freeing a socket, we thus need
|
|
|
5d360b |
to make sure that any pending message for this socket does not refer
|
|
|
5d360b |
to the socket any more.
|
|
|
5d360b |
|
|
|
5d360b |
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
|
5d360b |
Tested-by: Brian Candler <b.candler@pobox.com>
|
|
|
5d360b |
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
5d360b |
(cherry picked from commit ea64d5f08817b5e79e17135dce516c7583107f91)
|
|
|
5d360b |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
5d360b |
---
|
|
|
5d360b |
slirp/socket.c | 17 +++++++++++++++++
|
|
|
5d360b |
1 file changed, 17 insertions(+)
|
|
|
5d360b |
|
|
|
5d360b |
diff --git a/slirp/socket.c b/slirp/socket.c
|
|
|
5d360b |
index 8e8819c..09b5d3d 100644
|
|
|
5d360b |
--- a/slirp/socket.c
|
|
|
5d360b |
+++ b/slirp/socket.c
|
|
|
5d360b |
@@ -63,6 +63,23 @@ void
|
|
|
5d360b |
sofree(struct socket *so)
|
|
|
5d360b |
{
|
|
|
5d360b |
Slirp *slirp = so->slirp;
|
|
|
5d360b |
+ struct mbuf *ifm;
|
|
|
5d360b |
+
|
|
|
5d360b |
+ for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
|
|
|
5d360b |
+ (struct quehead *) ifm != &slirp->if_fastq;
|
|
|
5d360b |
+ ifm = ifm->ifq_next) {
|
|
|
5d360b |
+ if (ifm->ifq_so == so) {
|
|
|
5d360b |
+ ifm->ifq_so = NULL;
|
|
|
5d360b |
+ }
|
|
|
5d360b |
+ }
|
|
|
5d360b |
+
|
|
|
5d360b |
+ for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
|
|
|
5d360b |
+ (struct quehead *) ifm != &slirp->if_batchq;
|
|
|
5d360b |
+ ifm = ifm->ifq_next) {
|
|
|
5d360b |
+ if (ifm->ifq_so == so) {
|
|
|
5d360b |
+ ifm->ifq_so = NULL;
|
|
|
5d360b |
+ }
|
|
|
5d360b |
+ }
|
|
|
5d360b |
|
|
|
5d360b |
if (so->so_emu==EMU_RSH && so->extra) {
|
|
|
5d360b |
sofree(so->extra);
|
|
|
5d360b |
--
|
|
|
5d360b |
1.8.3.1
|
|
|
5d360b |
|