Re: [Qemu-stable] [Qemu-devel] [PATCH] slirp: Fix access to freed memory

[Stefan Hajnoczi]

On Mon, Nov 14, 2016 at 12:01:02AM +0100, Samuel Thibault wrote:
> if_start() goes through the slirp->if_fastq and slirp->if_batchq
> list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
> elements if ifm->ifq_so != NULL.  When freeing a socket, we thus need
> to make sure that any pending message for this socket does not refer
> to the socket any more.
> 
> Signed-off-by: Samuel Thibault <address@hidden>
> Tested-by: Brian Candler <address@hidden>
> ---
>  slirp/socket.c | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)

Reviewed-by: Stefan Hajnoczi <address@hidden>

Please send a slirp pull request for QEMU 2.8-rc0 (deadline November
15th) or -rc1 (deadline November 22nd).

CCing qemu-stable.

Stefan

signature.asc
Description: PGP signature