aboutsummaryrefslogtreecommitdiff
path: root/slirp/socket.c
diff options
context:
space:
mode:
authorSamuel Thibault <samuel.thibault@ens-lyon.org>2016-11-13 23:54:27 +0100
committerSamuel Thibault <samuel.thibault@ens-lyon.org>2016-11-14 17:36:33 +0100
commitea64d5f08817b5e79e17135dce516c7583107f91 (patch)
treea408d75f89b8237cbde64097a854ffc4f442922f /slirp/socket.c
parent83c83f9a5266ff113060f887f106a47920fa6974 (diff)
downloadqemu-arm-ea64d5f08817b5e79e17135dce516c7583107f91.tar.gz
slirp: Fix access to freed memory
if_start() goes through the slirp->if_fastq and slirp->if_batchq list of pending messages, and accesses ifm->ifq_so->so_nqueued of its elements if ifm->ifq_so != NULL. When freeing a socket, we thus need to make sure that any pending message for this socket does not refer to the socket any more. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Tested-by: Brian Candler <b.candler@pobox.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'slirp/socket.c')
-rw-r--r--slirp/socket.c17
1 files changed, 17 insertions, 0 deletions
diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a21f..6c18971368 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,23 @@ void
sofree(struct socket *so)
{
Slirp *slirp = so->slirp;
+ struct mbuf *ifm;
+
+ for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+ (struct quehead *) ifm != &slirp->if_fastq;
+ ifm = ifm->ifq_next) {
+ if (ifm->ifq_so == so) {
+ ifm->ifq_so = NULL;
+ }
+ }
+
+ for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+ (struct quehead *) ifm != &slirp->if_batchq;
+ ifm = ifm->ifq_next) {
+ if (ifm->ifq_so == so) {
+ ifm->ifq_so = NULL;
+ }
+ }
if (so->so_emu==EMU_RSH && so->extra) {
sofree(so->extra);