[Qemu-devel] [PULL] slirp: Fix access to freed memory

[Qemu-devel] [PULL] slirp: Fix access to freed memory

[Samuel Thibault]

The following changes since commit 83c83f9a5266ff113060f887f106a47920fa6974:

  Merge remote-tracking branch 'bonzini/tags/for-upstream' into staging (2016-11-11 12:51:50 +0000)

are available in the git repository at:

  http://people.debian.org/~sthibault/qemu.git tags/samuel-thibault

for you to fetch changes up to ea64d5f08817b5e79e17135dce516c7583107f91:

  slirp: Fix access to freed memory (2016-11-14 17:36:33 +0100)

----------------------------------------------------------------
slirp updates

----------------------------------------------------------------
Samuel Thibault (1):
      slirp: Fix access to freed memory

 slirp/socket.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

[Qemu-devel] [PULL] slirp: Fix access to freed memory

[Samuel Thibault]

if_start() goes through the slirp->if_fastq and slirp->if_batchq
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
elements if ifm->ifq_so != NULL.  When freeing a socket, we thus need
to make sure that any pending message for this socket does not refer
to the socket any more.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Brian Candler <b.candler@pobox.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 slirp/socket.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..6c18971 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,23 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+       (struct quehead *) ifm != &slirp->if_fastq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
+
+  for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+       (struct quehead *) ifm != &slirp->if_batchq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
 	sofree(so->extra);
-- 
2.10.2

Re: [Qemu-devel] [PULL] slirp: Fix access to freed memory

[no-reply]

Hi,

Your series seems to have some coding style problems. See output below for
more information:

Type: series
Subject: [Qemu-devel] [PULL] slirp: Fix access to freed memory
Message-id: 20161114202030.17685-2-samuel.thibault@ens-lyon.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

# Useful git options
git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag]         patchew/20161114202030.17685-2-samuel.thibault@ens-lyon.org -> patchew/20161114202030.17685-2-samuel.thibault@ens-lyon.org
Switched to a new branch 'test'
438b2d1 slirp: Fix access to freed memory

=== OUTPUT BEGIN ===
Checking PATCH 1/1: slirp: Fix access to freed memory...
ERROR: suspect code indent for conditional statements (4, 6)
#30: FILE: slirp/socket.c:74:
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;

ERROR: suspect code indent for conditional statements (4, 6)
#38: FILE: slirp/socket.c:82:
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;

total: 2 errors, 0 warnings, 23 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org

Re: [Qemu-devel] [PULL] slirp: Fix access to freed memory

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 940 bytes --]

On Mon, Nov 14, 2016 at 09:20:29PM +0100, Samuel Thibault wrote:
> The following changes since commit 83c83f9a5266ff113060f887f106a47920fa6974:
> 
>   Merge remote-tracking branch 'bonzini/tags/for-upstream' into staging (2016-11-11 12:51:50 +0000)
> 
> are available in the git repository at:
> 
>   http://people.debian.org/~sthibault/qemu.git tags/samuel-thibault
> 
> for you to fetch changes up to ea64d5f08817b5e79e17135dce516c7583107f91:
> 
>   slirp: Fix access to freed memory (2016-11-14 17:36:33 +0100)
> 
> ----------------------------------------------------------------
> slirp updates
> 
> ----------------------------------------------------------------
> Samuel Thibault (1):
>       slirp: Fix access to freed memory
> 
>  slirp/socket.c | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)
> 

Thanks, applied to my staging tree:
https://github.com/stefanha/qemu/commits/staging

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]