[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v1] chardev/char-socket: fix double free of err after socket is d
From: |
Derek Su |
Subject: |
[PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected |
Date: |
Wed, 24 Jun 2020 18:00:54 +0800 |
The err is freed in check_report_connect_error() conditionally,
calling error_free() directly may lead to a double-free bug.
Signed-off-by: Derek Su <dereksu@qnap.com>
---
chardev/char-socket.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index afebeec5c3..a009bed5ee 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1086,7 +1086,11 @@ static void qemu_chr_socket_connected(QIOTask *task,
void *opaque)
if (qio_task_propagate_error(task, &err)) {
tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
check_report_connect_error(chr, err);
- error_free(err);
+
+ if (!s->connect_err_reported) {
+ error_free(err);
+ }
+
goto cleanup;
}
--
2.17.1
- [PATCH v1] chardev/char-socket: fix double free of err after socket is disconnected,
Derek Su <=