From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58493) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cklAM-00088K-SL for qemu-devel@nongnu.org; Mon, 06 Mar 2017 00:26:39 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cklAM-0001Gz-6M for qemu-devel@nongnu.org; Mon, 06 Mar 2017 00:26:38 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47566) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cklAM-0001GP-0Q for qemu-devel@nongnu.org; Mon, 06 Mar 2017 00:26:38 -0500 From: Jason Wang Date: Mon, 6 Mar 2017 13:25:49 +0800 Message-Id: <1488777954-4578-15-git-send-email-jasowang@redhat.com> In-Reply-To: <1488777954-4578-1-git-send-email-jasowang@redhat.com> References: <1488777954-4578-1-git-send-email-jasowang@redhat.com> Subject: [Qemu-devel] [PULL RESEND 14/19] net/colo: fix memory double free error List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: peter.maydell@linaro.org, qemu-devel@nongnu.org Cc: zhanghailiang , Jason Wang From: zhanghailiang The 'primary_list' and 'secondary_list' members of struct Connection is not allocated through dynamically g_queue_new(), but we free it by using g_queue_free(), which will lead to a double-free bug. Reviewed-by: Zhang Chen Signed-off-by: zhanghailiang Signed-off-by: Jason Wang --- net/colo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/colo.c b/net/colo.c index 6a6eacd..8cc166b 100644 --- a/net/colo.c +++ b/net/colo.c @@ -147,9 +147,9 @@ void connection_destroy(void *opaque) Connection *conn = opaque; g_queue_foreach(&conn->primary_list, packet_destroy, NULL); - g_queue_free(&conn->primary_list); + g_queue_clear(&conn->primary_list); g_queue_foreach(&conn->secondary_list, packet_destroy, NULL); - g_queue_free(&conn->secondary_list); + g_queue_clear(&conn->secondary_list); g_slice_free(Connection, conn); } -- 2.7.4