From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41774) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c63ls-0000Vt-J4 for qemu-devel@nongnu.org; Sun, 13 Nov 2016 18:01:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c63lr-0006nE-KU for qemu-devel@nongnu.org; Sun, 13 Nov 2016 18:01:08 -0500 Received: from hera.aquilenet.fr ([2a01:474::1]:43518) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c63lr-0006n4-E0 for qemu-devel@nongnu.org; Sun, 13 Nov 2016 18:01:07 -0500 From: Samuel Thibault Date: Mon, 14 Nov 2016 00:01:02 +0100 Message-Id: <20161113230102.12173-1-samuel.thibault@ens-lyon.org> Subject: [Qemu-devel] [PATCH] slirp: Fix access to freed memory List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Samuel Thibault , jan.kiszka@siemens.com if_start() goes through the slirp->if_fastq and slirp->if_batchq list of pending messages, and accesses ifm->ifq_so->so_nqueued of its elements if ifm->ifq_so != NULL. When freeing a socket, we thus need to make sure that any pending message for this socket does not refer to the socket any more. Signed-off-by: Samuel Thibault Tested-by: Brian Candler --- slirp/socket.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/slirp/socket.c b/slirp/socket.c index 280050a..6c18971 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -66,6 +66,23 @@ void sofree(struct socket *so) { Slirp *slirp = so->slirp; + struct mbuf *ifm; + + for (ifm = (struct mbuf *) slirp->if_fastq.qh_link; + (struct quehead *) ifm != &slirp->if_fastq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } + + for (ifm = (struct mbuf *) slirp->if_batchq.qh_link; + (struct quehead *) ifm != &slirp->if_batchq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } if (so->so_emu==EMU_RSH && so->extra) { sofree(so->extra); -- 2.10.2