[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v1] chardev/char-socket: fix double free of err after socket
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected |
Date: |
Wed, 24 Jun 2020 12:12:40 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 |
On 6/24/20 12:00 PM, Derek Su wrote:
> The err is freed in check_report_connect_error() conditionally,
> calling error_free() directly may lead to a double-free bug.
This seems the same issue Lichun is working on, right?
https://www.mail-archive.com/qemu-devel@nongnu.org/msg714709.html
>
> Signed-off-by: Derek Su <dereksu@qnap.com>
> ---
> chardev/char-socket.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> index afebeec5c3..a009bed5ee 100644
> --- a/chardev/char-socket.c
> +++ b/chardev/char-socket.c
> @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task,
> void *opaque)
> if (qio_task_propagate_error(task, &err)) {
> tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
> check_report_connect_error(chr, err);
> - error_free(err);
> +
> + if (!s->connect_err_reported) {
> + error_free(err);
> + }
> +
> goto cleanup;
> }
>
>