From ea64d5f08817b5e79e17135dce516c7583107f91 Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Sun, 13 Nov 2016 23:54:27 +0100 Subject: slirp: Fix access to freed memory if_start() goes through the slirp->if_fastq and slirp->if_batchq list of pending messages, and accesses ifm->ifq_so->so_nqueued of its elements if ifm->ifq_so != NULL. When freeing a socket, we thus need to make sure that any pending message for this socket does not refer to the socket any more. Signed-off-by: Samuel Thibault Tested-by: Brian Candler Reviewed-by: Stefan Hajnoczi --- slirp/socket.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'slirp') diff --git a/slirp/socket.c b/slirp/socket.c index 280050a21f..6c18971368 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -66,6 +66,23 @@ void sofree(struct socket *so) { Slirp *slirp = so->slirp; + struct mbuf *ifm; + + for (ifm = (struct mbuf *) slirp->if_fastq.qh_link; + (struct quehead *) ifm != &slirp->if_fastq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } + + for (ifm = (struct mbuf *) slirp->if_batchq.qh_link; + (struct quehead *) ifm != &slirp->if_batchq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } if (so->so_emu==EMU_RSH && so->extra) { sofree(so->extra); -- cgit v1.2.3