[PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected

[PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected

[Derek Su]

The err is freed in check_report_connect_error() conditionally,
calling error_free() directly may lead to a double-free bug.

Signed-off-by: Derek Su <dereksu@qnap.com>
---
 chardev/char-socket.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index afebeec5c3..a009bed5ee 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
     if (qio_task_propagate_error(task, &err)) {
         tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
         check_report_connect_error(chr, err);
-        error_free(err);
+
+        if (!s->connect_err_reported) {
+            error_free(err);
+        }
+
         goto cleanup;
     }
 
-- 
2.17.1

Re: [PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected

[Philippe Mathieu-Daudé]

On 6/24/20 12:00 PM, Derek Su wrote:
> The err is freed in check_report_connect_error() conditionally,
> calling error_free() directly may lead to a double-free bug.

This seems the same issue Lichun is working on, right?
https://www.mail-archive.com/qemu-devel@nongnu.org/msg714709.html

> 
> Signed-off-by: Derek Su <dereksu@qnap.com>
> ---
>  chardev/char-socket.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> index afebeec5c3..a009bed5ee 100644
> --- a/chardev/char-socket.c
> +++ b/chardev/char-socket.c
> @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
>      if (qio_task_propagate_error(task, &err)) {
>          tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
>          check_report_connect_error(chr, err);
> -        error_free(err);
> +
> +        if (!s->connect_err_reported) {
> +            error_free(err);
> +        }
> +
>          goto cleanup;
>      }
>  
> 

Re: [PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected

[Derek Su]

[-- Attachment #1: Type: text/plain, Size: 1480 bytes --]

Oops! Sorry, I dont’t notice this patch before.

Thanks.

Derek

Philippe Mathieu-Daudé <philmd@redhat.com>於 2020年6月24日 週三，下午6:12寫道：

> On 6/24/20 12:00 PM, Derek Su wrote:
> > The err is freed in check_report_connect_error() conditionally,
> > calling error_free() directly may lead to a double-free bug.
>
> This seems the same issue Lichun is working on, right?
> https://www.mail-archive.com/qemu-devel@nongnu.org/msg714709.html
>
> >
> > Signed-off-by: Derek Su <dereksu@qnap.com>
> > ---
> >  chardev/char-socket.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> > index afebeec5c3..a009bed5ee 100644
> > --- a/chardev/char-socket.c
> > +++ b/chardev/char-socket.c
> > @@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask
> *task, void *opaque)
> >      if (qio_task_propagate_error(task, &err)) {
> >          tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
> >          check_report_connect_error(chr, err);
> > -        error_free(err);
> > +
> > +        if (!s->connect_err_reported) {
> > +            error_free(err);
> > +        }
> > +
> >          goto cleanup;
> >      }
> >
> >
>
> --

Best regards,

Derek Su
QNAP Systems, Inc.
Email: dereksu@qnap.com
Tel: (+886)-2-2393-5152 ext. 15017
Address: 13F., No.56, Sec. 1, Xinsheng S. Rd., Zhongzheng Dist., Taipei
City, Taiwan

[-- Attachment #2: Type: text/html, Size: 3063 bytes --]