From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55490) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XpCVn-0000Ei-0r for qemu-devel@nongnu.org; Fri, 14 Nov 2014 03:45:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XpCVh-0000tz-It for qemu-devel@nongnu.org; Fri, 14 Nov 2014 03:45:46 -0500 Sender: Paolo Bonzini Message-ID: <5465C130.1090401@redhat.com> Date: Fri, 14 Nov 2014 09:45:36 +0100 From: Paolo Bonzini MIME-Version: 1.0 References: <1415929163-12184-1-git-send-email-zhang.zhanghailiang@huawei.com> In-Reply-To: <1415929163-12184-1-git-send-email-zhang.zhanghailiang@huawei.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] l2tpv3: fix possible double free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: zhanghailiang , qemu-trivial@nongnu.org Cc: qemu-devel@nongnu.org, stefanha@redhat.com, peter.huangpeng@huawei.com On 14/11/2014 02:39, zhanghailiang wrote: > freeaddrinfo(result) does not assign result = NULL, after frees it. > There will be a double free when it goes error case. > It is reported by covertiy. > > Signed-off-by: zhanghailiang > --- > net/l2tpv3.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/l2tpv3.c b/net/l2tpv3.c > index 528d95b..f9e0c98 100644 > --- a/net/l2tpv3.c > +++ b/net/l2tpv3.c > @@ -661,6 +661,7 @@ int net_init_l2tpv3(const NetClientOptions *opts, > fd = -errno; > error_report("l2tpv3_open : socket creation failed, errno = %d", -fd); > freeaddrinfo(result); > + result = NULL; You can just remove the call to freeaddrinfo(). I made the change and applied the patch. Paolo > goto outerr; > } > if (bind(fd, (struct sockaddr *) result->ai_addr, result->ai_addrlen)) { >