[Xen-changelog] [qemu-xen master] slirp: Fix access to freed memory

[patchbot@xxxxxxx]

commit ea64d5f08817b5e79e17135dce516c7583107f91
Author:     Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
AuthorDate: Sun Nov 13 23:54:27 2016 +0100
Commit:     Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
CommitDate: Mon Nov 14 17:36:33 2016 +0100

    slirp: Fix access to freed memory
    
    if_start() goes through the slirp->if_fastq and slirp->if_batchq
    list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
    elements if ifm->ifq_so != NULL.  When freeing a socket, we thus need
    to make sure that any pending message for this socket does not refer
    to the socket any more.
    
    Signed-off-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
    Tested-by: Brian Candler <b.candler@xxxxxxxxx>
    Reviewed-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
---
 slirp/socket.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..6c18971 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,23 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+       (struct quehead *) ifm != &slirp->if_fastq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
+
+  for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+       (struct quehead *) ifm != &slirp->if_batchq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
        sofree(so->extra);
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog