[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 22/24] net/colo: Fix a "double free" crash to clear the conn_list
From: |
Jason Wang |
Subject: |
[PULL 22/24] net/colo: Fix a "double free" crash to clear the conn_list |
Date: |
Tue, 19 Jul 2022 21:16:35 +0800 |
From: Zhang Chen <chen.zhang@intel.com>
We notice the QEMU may crash when the guest has too many
incoming network connections with the following log:
15197@1593578622.668573:colo_proxy_main : colo proxy connection hashtable full,
clear it
free(): invalid pointer
[1] 15195 abort (core dumped) qemu-system-x86_64 ....
This is because we create the s->connection_track_table with
g_hash_table_new_full() which is defined as:
GHashTable * g_hash_table_new_full (GHashFunc hash_func,
GEqualFunc key_equal_func,
GDestroyNotify key_destroy_func,
GDestroyNotify value_destroy_func);
The fourth parameter connection_destroy() will be called to free the
memory allocated for all 'Connection' values in the hashtable when
we call g_hash_table_remove_all() in the connection_hashtable_reset().
But both connection_track_table and conn_list reference to the same
conn instance. It will trigger double free in conn_list clear. So this
patch remove free action on hash table side to avoid double free the
conn.
Signed-off-by: Like Xu <like.xu@linux.intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
net/colo-compare.c | 2 +-
net/filter-rewriter.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/colo-compare.c b/net/colo-compare.c
index d5d0965..787c740 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1323,7 +1323,7 @@ static void colo_compare_complete(UserCreatable *uc,
Error **errp)
s->connection_track_table = g_hash_table_new_full(connection_key_hash,
connection_key_equal,
g_free,
- connection_destroy);
+ NULL);
colo_compare_iothread(s);
diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
index bf05023..c18c4c2 100644
--- a/net/filter-rewriter.c
+++ b/net/filter-rewriter.c
@@ -383,7 +383,7 @@ static void colo_rewriter_setup(NetFilterState *nf, Error
**errp)
s->connection_track_table = g_hash_table_new_full(connection_key_hash,
connection_key_equal,
g_free,
- connection_destroy);
+ NULL);
s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
}
--
2.7.4
- [PULL 12/24] vhost: Expose vhost_svq_add, (continued)
- [PULL 12/24] vhost: Expose vhost_svq_add, Jason Wang, 2022/07/19
- [PULL 13/24] vhost: add vhost_svq_poll, Jason Wang, 2022/07/19
- [PULL 11/24] vhost: add vhost_svq_push_elem, Jason Wang, 2022/07/19
- [PULL 15/24] vdpa: Export vhost_vdpa_dma_map and unmap calls, Jason Wang, 2022/07/19
- [PULL 14/24] vhost: Add svq avail_handler callback, Jason Wang, 2022/07/19
- [PULL 16/24] vdpa: manual forward CVQ buffers, Jason Wang, 2022/07/19
- [PULL 17/24] vdpa: Buffer CVQ support on shadow virtqueue, Jason Wang, 2022/07/19
- [PULL 19/24] vdpa: Add device migration blocker, Jason Wang, 2022/07/19
- [PULL 18/24] vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs, Jason Wang, 2022/07/19
- [PULL 20/24] vdpa: Add x-svq to NetdevVhostVDPAOptions, Jason Wang, 2022/07/19
- [PULL 22/24] net/colo: Fix a "double free" crash to clear the conn_list,
Jason Wang <=
- [PULL 24/24] net/colo.c: fix segmentation fault when packet is not parsed correctly, Jason Wang, 2022/07/19
- [PULL 21/24] softmmu/runstate.c: add RunStateTransition support form COLO to PRELAUNCH, Jason Wang, 2022/07/19
- [PULL 23/24] net/colo.c: No need to track conn_list for filter-rewriter, Jason Wang, 2022/07/19
- Re: [PULL 00/24] Net Patches, Peter Maydell, 2022/07/19